Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

Artem — Fri, 12 Sep 2008 00:30:31 GMT

Great post, thanks. I wish you wrote it a bit earlier ;)

A couple of months ago I was evaluating Windows Server Security Guide. Default GPOs from there turn on UAC for user accounts (even administrators). That's generally a good thing, but not on Server Core. It's simply unable to display the UAC prompt, so the user can never elevate.

So I had to find out myself how to filter out the Cores using WMI.

re: Fun with WMI Filters in Group Policy

NedPyle — Fri, 12 Sep 2008 00:38:27 GMT

Rats - I wish you had commented/emailed us sooner. I wrote an internal article on this UAC scenario back in May, but no customer has ever called about the problem. I'll put this on the blog list.

- Ned

re: Fun with WMI Filters in Group Policy

Mkline — Sat, 13 Sep 2008 00:52:06 GMT

Group Policy MVP Darren Mar-Elia had a contest on his mailing list for a tough WMI problem. The original poster wanted a filter for desktop (no laptops)computers only.

A guy named Joel won the contest with this nice filter

"Select * from Win32_PhysicalMemory where FormFactor != 12

Returns True on computers that do not have SoDimm form factor memory and False on computers with SoDimm form factor memory. The assumption is that all laptops will have this style memory and desktops will not."

Very good filter that does the job for almost all hardware configs.

re: Fun with WMI Filters in Group Policy

NedPyle — Sat, 13 Sep 2008 00:54:46 GMT

That is quite clever!

- Ned

Das "Active Directory" Team online...

.: Michael Korp :. — Wed, 01 Oct 2008 17:58:49 GMT

Auch das Active Directory Team betreibt ein Blog , dass ich interessant zu lesen finde. Gestolpert darüber

re: Fun with WMI Filters in Group Policy

ls4bb — Thu, 02 Oct 2008 00:26:38 GMT

This is great!

If I need to filter just for non-server OS, will the following work?

SELECT ProductType FROM Win32_OperatingSystem WHERE ProductType <> “1”

For WMI filters in general, do they add more significant load on domain controllers because the filters are processed at GPO refresh interval?

Thank you.

re: Fun with WMI Filters in Group Policy

NedPyle — Thu, 02 Oct 2008 00:33:03 GMT

Hi,

If you wanted it to not be a server, you'd use:

SELECT ProductType FROM Win32_OperatingSystem WHERE ProductType = “1”

(the only difference being the equals sign). That will only return true if it's a workstation.

This should add no real load to the DC's, as the WMI processing happens client-side. Although it might make GP processing take just a bit longer on the client, and that would have the client talking to DC a bit longer, so I suppose in that sense there might be some tangental load... probably not measurable. :)

- Ned

re: Fun with WMI Filters in Group Policy

hilde — Tue, 07 Oct 2008 15:57:20 GMT

EXCELLENT! This is real-world useful stuff! Especially the text to use for certain OS type filters - KUDOS!

re: Fun with WMI Filters in Group Policy

dukkse — Fri, 24 Oct 2008 22:29:26 GMT

Hey!!

So, I have a WMI filter question for you related to above, I have half of it already, thanks. But, I need to filter out a Windows 2008 64 bit server, that is not a DC from everything else.

I have this so far, but somehow my Vista clients still get it, which I really dont want to. Here is my filter.

Select OSArchitecture,Version,ProductType from Win32_OperatingSystem where (OSArchitecture="64-bit") AND (Version like "6.0%") AND (ProductType="3")

Thanks

Daniel

re: Fun with WMI Filters in Group Policy

Craig — Fri, 24 Oct 2008 23:16:30 GMT

WBEMTEST returns true for that query on my 2008 x64 member server, and returns false on my Vista x64 machine.

Do you get those same results with WBEMTEST?

Just do Start, Run, WBEMTEST. Then click Connect, leave it as root\cimv2, then click Query, and paste in your query as-is, then click Apply. If you get 0 objects returned that is a False, 1 object returned is a True.

Filtering Automation Processes: Logon Scripts, Group Policy Settings

David M. Stein's Blog — Sat, 07 Mar 2009 05:29:43 GMT

For various reasons, you may want to restrict certain configuration processes to a subset of your environment

re: Fun with WMI Filters in Group Policy

club penguin — Sat, 16 May 2009 03:42:39 GMT

MUST College

jackiboa — Thu, 28 May 2009 08:39:30 GMT

I have half of it already, thanks. But, I need to filter out a Windows 2008 64 bit server, that is not a DC from everything else.

re: Fun with WMI Filters in Group Policy

NedPyle — Thu, 28 May 2009 16:44:00 GMT

This works for me (will apply to any 64-bit OS non-DC Win2008 server:

SELECT OSArchitecture,ProductType FROM Win32_OperatingSystem WHERE OSArchitecture = "64-bit" and ProductType = "3"

Is that what you're looking for?

re: Fun with WMI Filters in Group Policy

GarryWert — Sun, 26 Jul 2009 15:21:02 GMT

This is real-world useful stuff! Especially the text to use for certain OS type filters. Thanks.

re: Fun with WMI Filters in Group Policy

SallyB — Fri, 21 Aug 2009 23:16:48 GMT

It's always interesting to read your articles. I wish I could write as good as you!

re: Fun with WMI Filters in Group Policy

NedPyle — Fri, 21 Aug 2009 23:42:04 GMT

:) Thanks Sally, that made my day. Have a nice weekend.

- Ned

re: Fun with WMI Filters in Group Policy

Vistaprint Coupon — Sun, 01 Nov 2009 04:32:43 GMT

I must add - for various reasons, you may want to restrict certain a-type configuration processes to a subset of your virtual environment. This is true in many ways and it's good to keep it in mind.

re: Fun with WMI Filters in Group Policy

yoels@amdocs.com — Mon, 30 Nov 2009 13:24:22 GMT

I need a WMI Query (Filter) for IIS 6 or above, any Idea what class I should use?

re: Fun with WMI Filters in Group Policy

NedPyle — Mon, 30 Nov 2009 20:29:19 GMT

Hi Yoels,

Interesting problem. Here's one way to do it, you can explore the theme here. Make sure you test on Win2003 and later, as I only tested on Win2008. Also, make sure you use the double backslashes like I did below:

SELECT Version FROM CIM_DataFile WHERE Name = "c:\\windows\\system32\\inetsrv\\iisres.dll" AND Version >= "6"

This will see if the IISRES.DLL that IIS uses is installed and if it's version is equal to or greater than 6.

Let me know if that works for you. I must point out that IIS 5.0 only exists on Win2000 though, and since you cannot use WMI filters on Win2000, the version is rather moot. This would be more useful to see if it was IIS 7 or higher, for example.

Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

Das "Active Directory" Team online...

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

Top AskDS Blog Posts

Filtering Automation Processes: Logon Scripts, Group Policy Settings

re: Fun with WMI Filters in Group Policy

MUST College

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy

re: Fun with WMI Filters in Group Policy