none
How do we apply a Group Policy with Computer and User Settings using a WMI Filter?

    Question

  • Hello,

    We need to apply a Group Policy which consists of Computer Settings of Admin. Templates and Preferences with Windows Registry settings as well as User Settings with Preferences with Windows Registry settings. 

    How do we apply this policy with Computer and User settings using a WMI Filter?  Right now, applying this policy using a WMI Filter applies only the Computer Settings and not the User Settings.

    Thanks in advance for the help!


    MTV99
    Tuesday, March 08, 2011 8:39 PM

Answers

  • Hi,

     Just linked the GPO to an OU with users as well and it will apply to those. GPOs with both users and computer have to be linked to OUs that hold both the users and the computers that should be in the scope. 

     

    Thanks,

    Guy

    • Marked as answer by mtv99 Wednesday, March 09, 2011 4:46 PM
    Tuesday, March 08, 2011 10:22 PM
  • Thanks Guy.

    What I did find with this GPO is if I removed the Authenticated Users group and just filtered with the WMI filter, the GPO did not apply.  As a minimum, I had to have Authenticated Users and the WMI filter for the GPO to apply.

    In another test, I removed the Authenticated Users group and included 1 security group which included users and 1 security group which included workstations with no associated WMI filter.  Using the 2 security groups without including the Authenticated Users group and without including a WMI filter, the GPO applied successfully.


    MTV99
    Wednesday, March 09, 2011 4:46 PM

All replies

  • Hi,

     When you run gpresult on the client, does it indicate a reason why the user policies aren't applied? Where is the GPO linked? What is the WMI filter being used?

     

    Thanks,

    Guy

    Tuesday, March 08, 2011 9:05 PM
  • Hi Guy,

    When I run gpresult on the client, for the Computer Settings it shows the policy applied, but for the User Settings, nothing is displayed regarding the policy (ie. that is applied or was not applied).  

    The GPO is linked to an OU where the workstation is located, but no user accounts are located in the OU.

    The WMI filter searches the CIM_Datafile class and looks for the existence of a file and if found, applies the policy.

    Thanks


    MTV99
    Tuesday, March 08, 2011 9:34 PM
  • Hi,

     Just linked the GPO to an OU with users as well and it will apply to those. GPOs with both users and computer have to be linked to OUs that hold both the users and the computers that should be in the scope. 

     

    Thanks,

    Guy

    • Marked as answer by mtv99 Wednesday, March 09, 2011 4:46 PM
    Tuesday, March 08, 2011 10:22 PM
  • Guy,

    So does it work as follows:

    1. If Group Policy ABC linked to OU 'Users' which contains User Accounts and

    2. If Group Policy ABC linked to OU 'Workstations' which contains Computer Accounts and

    3. IF WMI Filter associated to Group Policy ABC and the query is successful

    then apply the Computer and User settings in Group Policy ABC to the User and Computer Accounts in the User and Workstations OUs which Group Policy ABC is linked to?

    Thanks!


    MTV99
    Wednesday, March 09, 2011 12:40 AM
  • That's correct. You can further filter the GPO to a subset of the users or computers in the OU by configuring the security delegation to a specific group (instead of authenticated users).

     

    Guy

    Wednesday, March 09, 2011 4:34 PM
  • Thanks Guy.

    What I did find with this GPO is if I removed the Authenticated Users group and just filtered with the WMI filter, the GPO did not apply.  As a minimum, I had to have Authenticated Users and the WMI filter for the GPO to apply.

    In another test, I removed the Authenticated Users group and included 1 security group which included users and 1 security group which included workstations with no associated WMI filter.  Using the 2 security groups without including the Authenticated Users group and without including a WMI filter, the GPO applied successfully.


    MTV99
    Wednesday, March 09, 2011 4:46 PM