Using WMI to Filter GPO’s based on Windows Version and Role

I’ve encountered these scenarios repeatedly in the past couple of weeks that I have to write them down.

• You want to implement a GPO setting for a product feature that occurs on two or more versions of the OS, however. However, the older version parameters do not work properly for the newer version, and vice versa (e.g., Bitlocker-related GPO settings that are Windows 7-specific, and do not work properly in Windows Vista)
• You want to implement a GPO in a high-level OU hierarchy, or a Domain level, but these settings should only be enforced on a Windows Server 2008 R2 machines, not on any other versions

In these cases you need to use WMI filters in your GPO’s. My personal description of WMI filters is that they are conditions that you can enforce in your GPO’s so that they are applied to a targetted set of computers, based on what is reflected by parameters that can be extracted through Windows Management Instrumentation, or WMI.

To create a WMI filter, use Group Policy Management Console and go to WMI filters. Create a new WMI filter. In the Query portion type your WMI query. In this example, my WMI Query is all Windows Server 2008 R2 machines, whether they are Member Servers or Domain Controllers.

Then apply the WMI Query on your GPO.

An example of a WMI Filter for all Windows Server 2008 R2 machines, whether member servers or domain controllers:

select * from Win32_OperatingSystem where Version like “6.1%” and (ProductType = “2″ or ProductType = “3”)

Version options are as follows

• Windows Server 2008 R2 or Windows 7 = 6.1%
• Windows Server 2008 or Windows Vista = 6.0%
• Windows Server 2003 = 5.2%
• Windows XP = 5.1%
• Windows 2000 = 5.0%

ProductType options are as follows:

• Client: ProductType=”1″
• Server: ProductType=”3″
• Domain Controller: ProductType=”2″