Using WMI Filters with GPOs

Many Windows IT pros rely on Active Directory (AD) Group Policy to centrally manage the technical behavior and rights of their Windows 2000 Server and later infrastructures. Some use the default Group Policy settings to enforce password policies, lock workstations after a certain period of inactivity, and customize user desktops. Some recent applications, such as Microsoft Software Update Services (SUS) and Windows XP Service Pack 2 (SP2) Windows Firewall, include Group Policy administrative templates that further leverage this centralized policy framework.

Most IT pros are familiar with the two most common methods for applying Group Policy: directly on the container (e.g., site, domain, organizational unit—OU, local object) and indirectly through security permission restrictions. In Windows Server 2003, Microsoft added Windows Management Instrumentation (WMI) filtering capabilities to let you further hone the scope of a Group Policy Object (GPO). WMI filters let you apply a GPO to only certain members of a container, according to whether the member satisfies the criteria that the filter specifies. For example, you can use WMI filters to target a Windows Installer package to client computers that have specific hardware configurations or a minimum amount of RAM and disk space on a particular drive. To take advantage of this filtering functionality, you need to know a bit about WMI.

WMI Architecture
WMI is the Microsoft implementation of Web-Based Enterprise Management (WBEM) technology, which defines a cross-platform standard and framework for managing systems. Microsoft exposes WMI providers that permit programs to query details about a particular system. You'll likely be interested primarily in properties such as the amount of memory or manufacturer of a computer system. A WMI property (e.g., manufacturer) is associated with a WMI class (e.g., Win32_ComputerSystem). This class is a member of a namespace (e.g., root\CIMv2). To learn more about WMI, read the Windows IT Pro article "Scripting with WMI," May 2003, InstantDoc ID 38498. . . .