Using Group Policy WMI Filters with examples

WMI Filters exist at the bottom on the Group Policy Management Console and are a way to target Group Policy Objects (GPOs) based on the results of the WMI query.

Other ways of targeting GPOs are by the OU that it is linked to (and the members of that OU), or by Active Directory security group.

WMI filters are useful as they can give you much more granularity, and are also dynamic. For example, if you’re applying a GPO to your PCs but only want it to apply to Windows 7, use a WMI filter. If the PC gets upgraded to Windows 10 the GPO will automatically stop applying. The only other way to do this would be to manually have all your Windows 7 PCs as a member of a security group or an OU, and have a way to ensure they were removed if the OS changed. Computers that are members of a security group have to be rebooted for the group membership change to take effect (this is when the computer account logs on to AD).

So, some filters:

  • VMware VMs only
    SELECT Model FROM Win32_ComputerSystem WHERE Model = “VMWare Virtual Platform”
  • For the inverse just add NOT after WHERE, e.g. everything except VMware VMs
    SELECT Model FROM Win32_ComputerSystem WHERE NOT Model = “VMWare Virtual Platform”
  • Hyper-V VM
    SELECT Model,Manufacturer FROM Win32_ComputerSystem WHERE Model = “Virtual Machine” AND Manufacturer = “Microsoft Corporation”
    I added Manufacturer as it makes it clearer that this is a Hyper-V VM as opposed to the “Model” property potentially just signifying a generic “Windows has detected that it is not running on physical hardware”. It does not do that, as far as I know Model = “Virtual Machine” is unique to Hyper-V. (e.g. for VirtualBox you use “VirtualBox”)
  • Physical servers (which in my environment means not VMware or Hyper-V)
    SELECT Model FROM Win32_ComputerSystem WHERE NOT Model LIKE “%Virtual%”
  • Laptops, or PCs & Servers with a UPS
    SELECT * FROM Win32_Battery
  • Windows 7
    SELECT Caption,Primary FROM Win32_OperatingSystem WHERE Caption LIKE ‘Microsoft Windows 7%’ AND Primary = TRUE
    Note that I’m checking the “Primary” property based on info in the book VBScript, WMI, and ADSI Unleashed by Don Jones (chapter 29, p.482). It is quite possibly not necessary.
  • Windows 7 or Server 2008 (inc. R2)
    SELECT Caption,Primary FROM Win32_OperatingSystem WHERE (Caption LIKE ‘Microsoft Windows Server 2008%’ AND Primary = TRUE) OR (Caption LIKE ‘Microsoft Windows 7%’ AND Primary = TRUE)
  • Computers with names beginning Finance
    SELECT Name FROM Win32_ComputerSystem WHERE Name LIKE ‘Finance%’
This entry was posted in Windows and tagged , , , , , , , , , , , , , , , , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s