How to find and use WMI values for Group Policy Filtering

The Ask the Performance Team has published a WMI Code Creator tool that allows queries your local WMI repository on your computer. This too can be useful if you want to find the WMI values to use with a WQL query filter for your Group Policy Objects (GPO). The tool itself does not actually create a WQL query for WMI filtering however you can it to get the required values and then then plug them into an existing WQL query.

Here I will take you though the WMI Code Creator tool to get the values to make a filter to apply a GPO only to Latitude D830 computers. You can customize the query by simply substituting the Class and Property values of your choice.

Step 1. Open the WMI Code Creator tool.

Step 2. Select the Class you want to use and then select the properties you want to filter on.

image

Step 3. Click the "Execute Code” button and you will see the value of the property

image

Take the highlighted values in the screen shots above and replace them in the query below.

Select * from Win32_ComputerSystem where model = ‘Latitude D830’

Step 4. Open Group Policy Management Console (GPMC) and navigate to Group Policy Management > Forest > Domains > DomainName > WMI Filters

Step 5. Click Action menu and then New…

image

Step 6. Enter the name of the WMI Filter then click Add (e.g. Latitude D830)

image

Step 7. Now enter the WQL query into the Query field and click OK

image

 

Step 8. Click Save

image

 

The filter will now be listed in the WMI Filters section of GPMC for use by other Group Policy Objects.

 

image

 

To use the Group Policy WMI filter select a GPO in GPMC and you will be able to select the filter in the “WMI Filtering” section at the bottom of the Scope tab.

 

image

 

So now you have applied a WMI filter to an existing GPO so that it will only be applied to Latitude D830 computers. This can be especially useful if you want to deploy hardware specific updates (e.g. drivers) to a particular type of computer.

 

Here are two other useful example of a WMI filter query:

 

Windows Vista or greater

SELECT Version, ProductType FROM Win32_OperatingSystem WHERE Version >= ‘6.0’ AND ProductType = ‘1’

 

Windows 7 of Greater

SELECT Version, ProductType FROM Win32_OperatingSystem WHERE Version >= ‘6.1’ AND ProductType = ‘1’

 

Additional Links

Author: Alan Burchill

Microsoft MVP (Group Policy)

7 thoughts on “How to find and use WMI values for Group Policy Filtering

  1. hey great post. wonderfully helpful.

    I’m wondering if there is a way to have a WMI query check the OU of the user logging on. I’d like a GPO to apply only to users if they’re in a certain OU – however, this is for Citrix so the overly obvious answer of – well just link it to that OU does not apply. This also cannot be done using security groups because a long time ago those started to get used as Distribution Groups and now too many are widely inaccurate. But OUs are accurate so I’d like to use those if I can. I’d like a WMI query filter to say, apply GPO if user is member of OU ‘x’

    doable?

  2. If it is a Group Policy Preference then yes… you can use the targeting of the item setting to make sure it is a particular users in an certain OU… if it is a native Group Policy then i dont think this is possible.

  3. Would negative filtering be also possible (i.e. applying a GPO to computers which do not run a specific service)?

Leave a Reply