GPO and WMI Filters

WMI Filters and GPOs are powerful when used in combination (though evaluating MWI filters may slow down policy processing). Just a few quick examples:

For settings that may need to be applied to workstations, but not servers one could go with something like this -

WMI queries for workstations vs. servers

​SELECT * FROM Win32_OperatingSystem WHERE (ProductType <> "2") AND (ProductType <> "3")     ​- workstations
​SELECT * FROM Win32_OperatingSystem WHERE ProductType = "1"     ​- workstations

ProductType 1 = Desktop OS
ProductType 2 = Server OS – Domain Controller
ProductType 3 = Server OS – Not a Domain Controller

For things like Bitlocker policy that needs to be applied to laptops only one could go with something like this -

WMI queries for laptops vs. desktops
​SELECT * FROM Win32_Battery WHERE (BatteryStatus <> 0)     ​- presence of a battery indicates laptop
​SELECT * FROM Win32_PhysicalMemory WHERE (FormFactor = 12)     ​- SODIMM memory indicates laptop

If you want a quick test for certain WMI values on a computer – use WMI command line tool (wmic) -

Here are some helpful links - 


Popular posts from this blog

PoSh Disable and Move AD Users

Skype for Business and VTC Interoperability

Mail-enabled security groups in Office 365