Group Policy WMI filtering

This is from hhttp://technet.microsoft.com/en-us/library/cc947846.aspx and http://technet.microsoft.com/en-us/library/cc758471.aspx but I have added more information with examples or WMI filters and a table of Windows version numbers and Product Types. WMI filters can take significant time to evaluate, so they can slow down logon and startup time. The amount of time depends on the construction of the query.

To restrict the query to only clients or only servers, add a clause that includes the ProductType parameter. To filter for client operating systems only, such as Windows 7 or Windows Vista, use only ProductType="1". For server operating systems that are not domain controllers, use ProductType="3". For domain controllers only, use ProductType="2". This is a useful distinction, because you often want to prevent your GPOs from being applied to the domain controllers on your network.

Examples

This query will return true for computers running Windows 7, Windows Vista, Windows Server 2008, and Windows Server 2008 R2. To set a filter for just Windows 7 and Windows Server 2008 R2, use "6.1%". To set a filter for Windows Server 2003, use "5.2%". For Windows XP, use "5.1%". For Windows 2000, use "5.0%". To specify multiple versions, combine them with or, as shown in the following:

select * from Win32_OperatingSystem where Version like "6.0%" or Version like "5.2%"

The following query returns true for any computer running Windows 2000, Windows XP, or Windows Server 2003, and false for any other version of Windows.

select * from Win32_OperatingSystem where Version like "5.%"

The following is for all computers that are not domain controllers:

select * from Win32_OperatingSystem where ProductType="1" or ProductType="3"

The following is for all computers running Windows XP

select * from Win32_OperatingSystem where (Version like "5.1%" or Version like "5.2%") and ProductType = "1"

The following is for all computers running Windows Vista

select * from Win32_OperatingSystem where Version like "6.0%" and ProductType="1"

The following is for any computer running Windows Server 2003, except domain controllers:

select * from Win32_OperatingSystem where Version like "5.2%" and ProductType="3"

The following is for Windows Server 2008 R2

select * from Win32_OperatingSystem where ProductType = "2" or ProductType = "3" and Version like "6.1%"

The following is for Windows 7

select * from Win32_OperatingSystem where Version like "6.1%" and ProductType="1"

The following is for Windows client machines (not servers)

select * from Win32_OperatingSystem where ProductType="1"

The following is for all Windows Servers

select * from Win32_OperatingSystem where ProductType="2" or ProductType="3"

The following is for Internet Explorer 7

SELECT path,filename,extension,version FROM CIM_DataFile WHERE path="\\Program Files\\Internet Explorer\\" AND filename="iexplore" AND extension="exe" AND version>"7.0"

The following is for Windows Server 2003 and Windows Server 2008

select * from Win32_OperatingSystem where (Version like "5.2%" or Version like "6.0%") and ProductType="3"

The following is for Windows 32-bit client machines

Select * from Win32_Processor where AddressWidth = "32"

select * from Win32_OperatingSystem where ProductType = "1"

SNAG-0118

The following is for Windows 64-bit client machines

Select * from Win32_Processor where AddressWidth = "64"

select * from Win32_OperatingSystem where ProductType = "1"

SNAG-0117

The following is for Windows 7 32-bit machines

select * from Win32_OperatingSystem where Version like "6.1%" and ProductType="1" and NOT OSArchitecture="64-bit"

The following is for Windows 7 64-bit machines

select * from Win32_OperatingSystem where Version like "6.1%" and ProductType="1" and OSArchitecture="64-bit"

The following is for Windows XP 64-bit machines

select * from Win32_OperatingSystem where Version like "5.2%" and ProductType="1"

The following is for Windows XP 32-bit machines

select * from Win32_OperatingSystem where Version like "5.1%" and ProductType="1"

The following is for Installed Memory (e.g. more than 1Gb)

Select * from WIN32_ComputerSystem where TotalPhysicalMemory >= 1073741824

After you have created a filter with the correct query, link the filter to the GPO. Filters can be reused with many GPOs simultaneously; you do not have to create a new one for each GPO if an existing one meets your needs.

Windows Versions and Product Types

Windows 7 or Server 2008 R2 = "6.1%"

Windows Vista or Server 2008 = "6.0%"

Windows Server 2003 = "5.2%"

Windows XP = "5.1%"

Windows 2000 = "5.0%"

Product Types

Client = "1"

Server running a Domain Controller role = "2"

Member server (server that’s not a DC) = "2"

To link a WMI filter to a GPO

On a computer that has the Group Policy Management feature installed, click Start, click Administrative Tools, and then click Group Policy Management. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. In the navigation pane, find and then click the GPO that you want to modify. Under WMI Filtering, select the correct WMI filter from the list. Click Yes to accept the filter.

Further Reading

http://technet.microsoft.com/pt-pt/library/cc904288(WS.10).aspx

2 Comments

  1. Jonathan Shapiro

    Nice article. I have a follow up question. How do I combine two WMI queries? I need to limit a GPO to 32 bit machines newer than XP. I have the two queries, but I don’t know how to make them into one:

    Select * from Win32_Processor where AddressWidth = ’32’
    Select Version FROM Win32_OperatingSystem WHERE Version > “5.9”

  2. Excellent goods from you, man. I’ve understand your stuff previous to and you arre just extremely wonderful.I
    really like what you have acquired here, certainly like what you’re saying and the way in which you say it.
    You make it entertaining and you still care for to keep it wise.
    I can’t wait too read much more from you. This is really
    a tremendous web site.

Leave a comment