# Get the Class instance
$oIPMI=Get-WmiObject -Namespace root\WMI -Class MICROSOFT_IPMI
# Some constants
# <a title="Microsoft In Band Management" href="http://gallery.technet.microsoft.com/scriptcenter/In-Band-Management-using-88e221b8" target="_blank">Source</a>
[byte]$BMCResponderAddress = 0x20
[byte]$GetLANInfoCmd = 0x02
[byte]$GetChannelInfoCmd = 0x42
[byte]$SetSystemInfoCmd = 0x58
[byte]$GetSystemInfoCmd = 0x59
[byte]$DefaultLUN = 0x00
[byte]$IPMBProtocolType = 0x01
[byte]$8023LANMediumType = 0x04
[byte]$MaxChannel = 0x0b
[byte]$EncodingAscii = 0x00
[byte]$MaxSysInfoDataSize = 19
# Find the first channel
[byte[]]$RequestData=@(0)
$oMethodParameter=$oIPMI.GetMethodParameters("RequestResponse")
$oMethodParameter.Command=$GetChannelInfoCmd
$oMethodParameter.Lun=$DefaultLUN
$oMethodParameter.NetworkFunction=0x06
$oMethodParameter.RequestData=$RequestData
$oMethodParameter.RequestDataSize=$RequestData.length
$oMethodParameter.ResponderAddress=$BMCResponderAddress
# http://msdn.microsoft.com/en-us/library/windows/desktop/aa392344%28v=vs.85%29.aspx
$RequestData=@(0)
[Int16]$iLanChannel=0
[bool]$bFoundLAN=$false
for(;$iLanChannel -le $MaxChannel;$iLanChannel++){
   $RequestData=@($iLanChannel)
   $oMethodParameter.RequestData=$RequestData
   $oMethodParameter.RequestDataSize=$RequestData.length
   $oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
   #$oRet
   if($oRet.ResponseData[2] -eq $8023LANMediumType){
       $bFoundLAN=$true
       break;
    }
}
# If the LAN channel was found, get the network parameters
$oMethodParameter.Command=$GetLANInfoCmd
$oMethodParameter.NetworkFunction=0x0c
if($bFoundLAN){
   $RequestData=@($iLanChannel,3,0,0)
   $oMethodParameter.RequestData=$RequestData
   $oMethodParameter.RequestDataSize=$RequestData.length
   $oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
   write-host ("IP Address:     "+$oRet.ResponseData[2]+"."+$oRet.ResponseData[3]+"."+$oRet.ResponseData[4]+"."+ $oRet.ResponseData[5] )
   $RequestData=@($iLanChannel,6,0,0)
   $oMethodParameter.RequestData=$RequestData
   $oMethodParameter.RequestDataSize=$RequestData.length
   $oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
   write-host ("Subnet Mask:    "+$oRet.ResponseData[2]+"."+$oRet.ResponseData[3]+"."+$oRet.ResponseData[4]+"."+ $oRet.ResponseData[5] )
   $RequestData=@($iLanChannel,5,0,0)
   $oMethodParameter.RequestData=$RequestData
   $oMethodParameter.RequestDataSize=$RequestData.length
   $oRet=$oIPMI.PSBase.InvokeMethod("RequestResponse",$oMethodParameter,(New-Object System.Management.InvokeMethodOptions))
   # Format http://msdn.microsoft.com/en-us/library/dwhawy9k.aspx
   write-host ("MAC Address:    "+("{0:x2}:{1:x2}:{2:x2}:{3:x2}:{4:x2}:{5:x2}" -f $oRet.ResponseData[2], $oRet.ResponseData[3],$oRet.ResponseData[4], $oRet.ResponseData[5], $oRet.ResponseData[6], $oRet.ResponseData[7]))
}