The Ask the Performance Team has published a WMI Code Creator tool that allows queries your local WMI repository on your computer. This too can be useful if you want to find the WMI values to use with a WQL query filter for your Group Policy Objects (GPO). The tool itself does not actually create a WQL query for WMI filtering however you can it to get the required values and then then plug them into an existing WQL query.
Here I will take you though the WMI Code Creator tool to get the values to make a filter to apply a GPO only to Latitude D830 computers. You can customize the query by simply substituting the Class and Property values of your choice.
Step 1. Open the WMI Code Creator tool.
Step 2. Select the Class you want to use and then select the properties you want to filter on.
Step 3. Click the "Execute Code†button and you will see the value of the property
Take the highlighted values in the screen shots above and replace them in the query below.
Select * from Win32_ComputerSystem where model = ‘Latitude D830’
Step 4. Open Group Policy Management Console (GPMC) and navigate to Group Policy Management > Forest > Domains > DomainName > WMI Filters
Step 5. Click Action menu and then New…
Step 6. Enter the name of the WMI Filter then click Add (e.g. Latitude D830)
Step 7. Now enter the WQL query into the Query field and click OK
Step 8. Click Save
The filter will now be listed in the WMI Filters section of GPMC for use by other Group Policy Objects.
To use the Group Policy WMI filter select a GPO in GPMC and you will be able to select the filter in the “WMI Filtering†section at the bottom of the Scope tab.
So now you have applied a WMI filter to an existing GPO so that it will only be applied to Latitude D830 computers. This can be especially useful if you want to deploy hardware specific updates (e.g. drivers) to a particular type of computer.
Here are two other useful example of a WMI filter query:
Windows Vista or greater
SELECT Version, ProductType FROM Win32_OperatingSystem WHERE Version >= ‘6.0’ AND ProductType = ‘1’
Windows 7 of Greater
SELECT Version, ProductType FROM Win32_OperatingSystem WHERE Version >= ‘6.1’ AND ProductType = ‘1’
Additional Links
- To get the WMI Code Creator tool visit Ask the Performance Team : Two Minute Drill – WMI Code Creator
- For more information about group policy filtering see Security Filtering, WMI Filtering, and Item-level Targeting in Group Policy Preferences
- Another use of WMI filtering is in SCCM Operating System Deployment see Driver Management (Part 1) – Configuration Manager
Blog Post: How to find and use WMI values for Group Policy Filtering http://bit.ly/9yuHia
RT @grouppolicy_biz: Blog Post: How to find and use WMI values for Group Policy Filtering http://bit.ly/9yuHia
hey great post. wonderfully helpful.
I’m wondering if there is a way to have a WMI query check the OU of the user logging on. I’d like a GPO to apply only to users if they’re in a certain OU – however, this is for Citrix so the overly obvious answer of – well just link it to that OU does not apply. This also cannot be done using security groups because a long time ago those started to get used as Distribution Groups and now too many are widely inaccurate. But OUs are accurate so I’d like to use those if I can. I’d like a WMI query filter to say, apply GPO if user is member of OU ‘x’
doable?
If it is a Group Policy Preference then yes… you can use the targeting of the item setting to make sure it is a particular users in an certain OU… if it is a native Group Policy then i dont think this is possible.
Would negative filtering be also possible (i.e. applying a GPO to computers which do not run a specific service)?