Skip to main content

GPO and WMI Filters

WMI Filters and GPOs are powerful when used in combination (though evaluating MWI filters may slow down policy processing). Just a few quick examples:

For settings that may need to be applied to workstations, but not servers one could go with something like this -

WMI queries for workstations vs. servers
 

​SELECT * FROM Win32_OperatingSystem WHERE (ProductType <> "2") AND (ProductType <> "3")     ​- workstations
​SELECT * FROM Win32_OperatingSystem WHERE ProductType = "1"     ​- workstations

ProductType 1 = Desktop OS
ProductType 2 = Server OS – Domain Controller
ProductType 3 = Server OS – Not a Domain Controller


For things like Bitlocker policy that needs to be applied to laptops only one could go with something like this -

WMI queries for laptops vs. desktops
​SELECT * FROM Win32_Battery WHERE (BatteryStatus <> 0)     ​- presence of a battery indicates laptop
​SELECT * FROM Win32_PhysicalMemory WHERE (FormFactor = 12)     ​- SODIMM memory indicates laptop

If you want a quick test for certain WMI values on a computer – use WMI command line tool (wmic) -



Here are some helpful links - 


Comments

Popular posts from this blog

Mail-enabled security groups in Office 365

Another update (11/19/2013):  further evolution of Office 365 services makes creation of distribution and security groups even easier, plus there's now an option of creating a dynamic distribution group (click here for more information):    Update (08/06/2012): a clear sign of Office 365 evolving along the same lines as other agile cloud services - small incremental features and minor new functionality are being delivered almost continuously and, unlike important major service updates,  without much fanfare. For example, there's no need to resort to using PowerShell to setup mail-enabled security groups anymore, it can now be done at creation using management portal:       Those managing Office 365 ( O365 ) tenant via the Microsoft Online Services Portal  ( MOS Portal ) interface would notice that there are two distinct group entities: Security Groups: can be created via MOS Portal (main portal page>Management>Security Groups) and used for assigning

Drumbeat - Sales and Technical Resources for Office 365

​ Drumbeat - provides information as well as technical and sales resources for Office 365. From partnering with Microsoft, to building up your sales and technical readiness, to adopting proven methodologies for successful deployment - you will find lots of good information and many helpful links there. Here's a quick sample of topics covered: The Customer Decision Framework is Microsoft's selling methodology designed to help partners sell Office 365 to their customers. Office 365 FastTrack is Microsoft's new, 3-step pilot and deployment methodology designed so customers experience service value early in the sales cycle with a smooth path to advance from a pilot to deployment.

Sample DS Command

PowerShell is all the hype these days, and rightfully so - you can do just about anything with it; but, call me old-fashioned I still like to use ds commands every now and then, it's quick and dirty. Here are a few samples that query AD and to get some basic counts and other information: # Get a count of enabled and disabled user accounts in the domain dsquery user -limit 0 domainroot | dsget user -dn -disabled | find /c /i " no" dsquery user -limit 0 domainroot | dsget user -dn -disabled | find /c /i " yes" # Get a count of enabled and disabled computer accounts in the domain dsquery computer -limit 0 domainroot | dsget computer -dn -disabled | find /c /i " no" dsquery computer -limit 0 domainroot | dsget computer -dn -disabled | find /c /i " yes" # Get a count of enabled, but inactive (at least 24 weeks) user and computer accounts in the domain dsquery user -inactive 24 -limit 0 domainroot | dsget user -dn -disabled | find /c /i