WMI Filter for Computer by OU

[Len Nally]

I am after a method of filtering the application of a user
based GPO based on the OU membership of the particular
computer they are logging onto. Can a query be made in
WMI Filtering to determine the location of the computer
object in Active Directory?

[Kevin Sullivan]

Digging through CIM studio to try and find a reference but I can't seem to
find one. I would be curious if anyone does. WMI filters are fantastic for
filtering entire GPOs to only hit a subset of the user or computer objects
in its path. They are a bit difficult to work with but after a little effort
they start to make a lot of sense.

WMI is a great addition to Group Policy and adds to the almost non-existant
targeting mechanism. Unfortunately it is all or nothing. You can put a
filter on the GPO but not the individual settings in the GPO. This level of
targeting you really need to take a look at third party solutions providing
extensions to Group Policy.

Kevin
AutoProf
http://www.autoprof.com/policy

"Len Nally" <anon...@discussions.microsoft.com> wrote in message
news:33fc01c4a506$3f203a40$a301...@phx.gbl...

[lnally]

I found out a way to filter the application of a user policy based on the
applied computer policy. I created a WMI query to check for a particular
GP as follows:

Namespace: root\RSOP\Computer
Query: select * from RSOP_GPO where guidName = "{XXXXXXXXXXXXXX}"

Just put the GUID of the GP object in the query in place of the XX's.
The only problem with this method is that it was bandwidth intensive and
caused logon delays when the client and DC were seperated over a slow
link.

[lnally]

[Mark Williams [MSFT]]

Hi there. I may have missed the earlier part of this thread but what is the
overall scenario you are trying to address? From your description I am
wondering whether Loopback process is more suitable. See the Group Policy
Wiki for information on this feature: http://grouppolicy.editme.com/Loopback

Also, I have just updated the Wiki page on WMI Filters to make an important
point about how and when they should be considered for us. See the "When To
Use (And Not Use) WMI Filters" section here:
http://grouppolicy.editme.com/WMIFilters

I hope this helps.

--
Mark Williams
Program Manager, Group Policy
http://www.microsoft.com/technet/grouppolicy
Play a Role - Contribute To The Group Policy Wiki
http://www.grouppolicywiki.com

This posting is provided "AS IS" with no warranties, and confers no rights.

"lnally" <len....@nospam.bendigobank.com.au> wrote in message
news:c6639b6e871d3045...@localhost.talkaboutsoftware.com...