Monday, May 23, 2011

Home /Active Directory /firewall /Group Policy /Microsoft /WIM /Windows /Windows 2008 R2 / Group Policy Objects (GPO) and WMI Filter

Group Policy Objects (GPO) and WMI Filter

As you know, Windows Management Instrumentation (WMI) filters allow you to dynamically determine the scope of Group Policy objects (GPOs) based on attributes of the target computer. I started seeing many questions about verifying these WMI Filters prior to implementing it. You can use the wbemtest tool to verify the result.

More info about wbemtest tool - http://technet.microsoft.com/en-us/library/ee692770.aspx

In this example my goal is to verify an IP address using a WMI query. 

1.  Open wbemtest tool (Run -> type wbemtest)

2.  On the Windows Management Instrumentation Tester window, select Connect.

Note: For the local machine, click Connect with correct Namespace. For a remote computer, use the \\Remte\root\cimv2 format.

image

3.  Select Query button. 

image

4.  Enter your query string in the Enter Query box and click Apply

Note: In the below example, I am searching for 10.15.2.X IP address in the IP V4 Windows Routing Table. 

image

When a GPO that is linked to a WMI filter is applied on the target computer, the filter is evaluated on the target computer. If the WMI filter evaluates to false, the GPO is not applied (except if the client computer is running Windows 2000, in which case the filter is ignored and the GPO is always applied).  If the WMI filter evaluates to true, the GPO is applied.

As you can see in the following screenshot, the select * from Win32_IP4RouteTable Where Name Like "192.168.10.%" query returns a True value. 

image

In this example, select * from Win32_IP4RouteTable Where Name Like "192.168.10.%" query returns a  False value. 

image

 
 
 
 
 
SS

Santhosh Sivarajan

Microsoft MVP · Identity & Cybersecurity Architect

Santhosh has 30+ years of hands-on enterprise experience in Identity and Access Management, Microsoft Entra ID, Active Directory, Microsoft 365 and Zero Trust architecture. He is the author of two books on Windows Server and security, and leads consulting, assessments and training at SAG Business Group.

2 comments:

Hi I have created a new property for Win32_UserAccount class and named it as "Department". I want to link the value of the user's department attribute to this property . How to do this. I think it is possible because the value of user's name attribute is linked to the property Name in the Win32_UserAccount Class. Please help me with this.

Colombia has a diverse and rich racial composition, which is why women have colombian brides different appearances. But usually they have a sensual body color with tanned or olive skin. Nothing compares to family and they believe that no money can buy that which is enduring and steady in a relationship with a man.

Post a Comment

Popular Posts
Workstation Trust Relationship Issue Issue: You receive the following error message, when you try to login to the domain.  The security database on the server does not have ... ADMT Service Account - Permission and Configuration The ADMT service account needs to have proper permission in source and target domains.  You don’t need to use 2 separate accounts.  You can ... My First Peek into Microsoft Exchange 2010 By Santhosh Sivarajan Before I really dive into Exchange 2010, I thought I would install and play with it first. I took some screen shots and notes during the ins... ObjectSID and Active Directory What is an objectSID in Active Directory? When a new object is created in Active Directory, Domain Controller assigns a unique value used ... AD Group Report - List Group Members in Active Directory–PowerShell Script Updated Script - http://portal.sivarajan.com/2011/10/search-ad-collect-local-admin-group.html Script #1 This script... Add Users to a Group–PowerShell Script Purpose – Add users to a group from an input file – PowerShell V2 Script.  Input file – Input file (Users.csv) contains samAccountName in... User Account Migration and Merging – Part I (ADMT) Part I - User Account Migration and Merging Using ADMT Part II - User Account Migration and Merging Using QMM pre-creating user account ... User Account Migration and Merging – Part II (Quest Migration Manager) Part I - User Account Migration and Merging Using ADMT Part II - User Account Migration and Merging Using QMM Pre-creating user account in... Delete Stale or Inactive Computer Accounts from Active Directory Here is an easy way to identify and delete inactive or stale computers in an Active Directory environment.  Using the dsquery command you c... Converting PowerShell (PS1) to EXE / Standalone Application As we know, there many applications available to convert a PowerShell file to a standalone executable file.  Based on my experience, PowerSh...