Group Policy Central

In my previous article In this article Best Practice:Active Directory Structure Guidelines – Part 1 I spoke about some of the guidelines I personally use when developing an Active Directory OU structure. In this next part I will discuss some guidelines I use when designing a Group Policy Object infrastructure.

Ideally you should make the the Active Directory OU and GPO design decision together to best ensure that you have the most efficient design possible. However if you have an existing OU structure designed a lot of these guidelines can still be applied to most existing environments.

As in Part 1 these are simply guidelines that I use and should not be taken as hard an fast rules. I quite often finding myself having to break these rules due to real world conflicts or just because one rule might conflict with the other rule. If you do find your self in a situation where you are not sure which path to take try to chose the option that will result in the least administrative effort in the long term.

Continue reading ‘Best Practice: Group Policy Design Guidelines – Part 2’ »

The Ask the Performance Team has published a WMI Code Creator tool that allows queries your local WMI repository on your computer. This too can be useful if you want to find the WMI values to use with a WQL query filter for your Group Policy Objects (GPO). The tool itself does not actually create a WQL query for WMI filtering however you can it to get the required values and then then plug them into an existing WQL query.

Here I will take you though the WMI Code Creator tool to get the values to make a filter to apply a GPO only to Latitude D830 computers. You can customize the query by simply substituting the Class and Property values of your choice.

Step 1. Open the WMI Code Creator tool.

Step 2. Select the Class you want to use and then select the properties you want to filter on.

Step 3. Click the "Execute Code” button and you will see the value of the property

Take the highlighted values in the screen shots above and replace them in the query below.

Select * from Win32_ComputerSystem where model = ‘Latitude D830’

Step 4. Open Group Policy Management Console (GPMC) and navigate to Group Policy Management > Forest > Domains > DomainName > WMI Filters

Step 5. Click Action menu and then New…

Step 6. Enter the name of the WMI Filter then click Add (e.g. Latitude D830)

Step 7. Now enter the WQL query into the Query field and click OK

Step 8. Click Save

The filter will now be listed in the WMI Filters section of GPMC for use by other Group Policy Objects.

To use the Group Policy WMI filter select a GPO in GPMC and you will be able to select the filter in the “WMI Filtering” section at the bottom of the Scope tab.

So now you have applied a WMI filter to an existing GPO so that it will only be applied to Latitude D830 computers. This can be especially useful if you want to deploy hardware specific updates (e.g. drivers) to a particular type of computer.

Here are two other useful example of a WMI filter query:

Windows Vista or greater

SELECT Version, ProductType FROM Win32_OperatingSystem WHERE Version >= ’6.0′ AND ProductType = ’1′

Windows 7 of Greater

SELECT Version, ProductType FROM Win32_OperatingSystem WHERE Version >= ’6.1′ AND ProductType = ’1′

Additional Links

• To get the WMI Code Creator tool visit Ask the Performance Team : Two Minute Drill – WMI Code Creator
• For more information about group policy filtering see Security Filtering, WMI Filtering, and Item-level Targeting in Group Policy Preferences
• Another use of WMI filtering is in SCCM Operating System Deployment see Driver Management (Part 1) – Configuration Manager