/build/static/layout/Breadcrumb_cap_w.png

Using WMI to Target Desktop Policies in Group Policy & Preferences

Hi, this is Greg Shields and I'm going to show you the differences between Group Policy and Group Policy Preferences, and how they use WMI as their database for targeting policies.

You'll see that I have two different Group Policies brought up.' The one I have on the left is a Group Policy and I'm taking a look at the Disk Quotas node here under Administrative Templates.' On the right I'm taking a look at a Group Policy Preference, in this case an environment variable.' Now, if you haven't played with Group Policy Preferences, one of the great things about Group Policy Preferences is the fact that I can take a look at their properties and under the Common tab I can actually apply Item Level Targeting to those policies.

You'll see here that for those policies, I've actually created a Targeting Item that directs this policy to apply only when the computer is a Windows 7 operating system that's actually 64-bit and Enterprise Edition.' There are actually six different editions I can use here:' Enterprise, Business, Ultimate, or the 64-bit versions of any of these that I can apply for this target for this Group Policy Preference.

Now this Targeting Editor is nothing more than a skin, a nice graphical skin, over the top of WMI and the WQL queries that you'll actually use to query against WMI.' If I click OK here, I could potentially create another Group Policy Preference and apply another even different targeting to that second Group Policy.

Now this is somewhat different than how we do things with traditional Group Policies.' Traditional Group Policies need to be targeted at the Group Policy layer and not at the individual setting layer.' So, because of that, I actually do the targeting for Group Policies back here under Group Policy Management.

You'll see I'm taking a look here at the Group Policy Management Console and down here at the bottom I have the WMI Filtering node.' Now, WMI Filtering is the process that's used for traditional Group Policy and unlike the very nice Targeting Editor that I have for Group Policy Preferences.' In order to be able to do this, I need to do this be able to construct a WQL query to determine what sorts of characteristics in the WMI database that I want to target against.

If I go down here to WMI Filters and choose New I can create a new WMI Filter.' Let's create one similar to what I just did with the Group Policy Preference.' I'll call this Windows 7 x64, and I'll click the Add button here against the root\CIMv2 namespace ' this is the default namespace for a lot of these queries ' and paste in the query that I talked about in the article.' Here it's select * from Win32_OperatingSystem WHERE Version like "6.1%" AND ProductType="1" AND OSArchitecture = "64-bit".

Now you will have to sleuth through the Internet and through just some testing of your own to figure out what those queries are, because they can be somewhat challenging to create.' Once you have created one that works for you, the last step in the process is to go back up to the Group Policy that you want to assign that filter to and change the filter to None to the filter you just created.

Always remember, however, that Group Policy filters can be defined both at the policy level and if you're a preference again at the preference level.' So you have to be kind of careful with where you assign the targeting, because you want to make sure that both the policy targets correctly as well as any individual preferences you create.


Comments

This post is locked
 
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ