none
WMI Filter failing for Windows 2016 RTM

    Question

  • We use the following WMI filter to prevent certain GPO settings from being applied to servers when a server administrator logs into them:

    select * from Win32_OperatingSystem where Version like "10.%" or Version like "6.%" and ProductType = "1"

    So if an Admin logs into a Windows 7 or Windows 10 workstation, the GPO get applied.  If they login to Windows 2008 R2 or Windows 2012 R2 it does not.

    I setup a test Server 2016 box and logged in, and noticed the filter is not working.  The GPO is being applied.  The ProductType is 3 on a server so it should be failing the test...I confirmed this with a GWMI PS command to check the ProductType value.

    Anyone else seen this problem?

    Thanks

    NK


    • Edited by NJK-Work Wednesday, October 26, 2016 8:44 PM
    Wednesday, October 26, 2016 8:43 PM

Answers

  •  
    > select * from Win32_OperatingSystem where Version like "10.%" or Version
    > like "6.%" and ProductType = "1"
     
    Small lack of understanding how boolean operators take precedence :-)
     
    Your query resolves to
     
    select * from Win32_OperatingSystem where Version like "10.%" or (
    Version like "6.%" and ProductType = "1" )
     
    What you want is
     
    select * from Win32_OperatingSystem where ( Version like "10.%" or
    Version like "6.%" ) and ProductType = "1"
     
    • Marked as answer by NJK-Work Thursday, October 27, 2016 1:08 PM
    Thursday, October 27, 2016 11:01 AM

All replies

  • Hi,
    Have you also tried to test on windows 7 and windows 10 or Windows 2008 R2 or Windows 2012 R2 and see if WMI is working?
    In addition, please take a look at the following article and follow it to try again and see if it works:
    How to apply WMI Filter to Windows 10 or Windows Server 2016
    http://www.grouppolicy.biz/2015/05/how-to-apply-wmi-filter-to-windows-10-or-windows-server-2016/
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, October 27, 2016 6:17 AM
    Moderator
  •  
    > select * from Win32_OperatingSystem where Version like "10.%" or Version
    > like "6.%" and ProductType = "1"
     
    Small lack of understanding how boolean operators take precedence :-)
     
    Your query resolves to
     
    select * from Win32_OperatingSystem where Version like "10.%" or (
    Version like "6.%" and ProductType = "1" )
     
    What you want is
     
    select * from Win32_OperatingSystem where ( Version like "10.%" or
    Version like "6.%" ) and ProductType = "1"
     
    • Marked as answer by NJK-Work Thursday, October 27, 2016 1:08 PM
    Thursday, October 27, 2016 11:01 AM
  • Yes - it works perfectly for Windows 2008 R2 and Windows 2012 R2 servers - no GPO setting are applied.  It DOES apply on Windows 7 and 10 machines.

    Thanks

    NK

    Thursday, October 27, 2016 1:06 PM
  • That's what I was thinking too. My first thought was do what you suggested. However, since it works fine for Windows 2008 R2 and 2012 R2 servers, I ignored that option. But I will give it a shot (although still confused how this was working for older OS versions).

    Thanks

    NK

    Thursday, October 27, 2016 1:08 PM
  • Hi
     
    Am 26.10.2016 um 22:43 schrieb NJK-Work:
    > select * from Win32_OperatingSystem where Version like "10.%" or
    > Version like "6.%" and ProductType = "1"
     
    select * from Win32_OperatingSystem where Version like ("10.%" or
    Version like "6.%") and ProductType = "1"
     
    Alternativ: create two queries in one WMI Filter
    select * from Win32_OperatingSystem where Version like "10.%" or Version
    like "6.%"
    select * from Win32_OperatingSystem where  ProductType = "1"
     
    They will always be an "AND"
     
    Mark
    --
    Mark Heitbrink - MVP Group Policy - Cloud and Datacenter Management
     
    Homepage:  http://www.gruppenrichtlinien.de - deutsch
     
    Thursday, October 27, 2016 1:39 PM
  • Am 26.10.2016 um 22:43 schrieb NJK-Work:
    > select * from Win32_OperatingSystem where Version like "10.%" or
    > Version like "6.%" and ProductType = "1"
     
    Your filter will be read like:
    select * from Win32_OperatingSystem where Version like "10.%" or
    (Version like "6.%" and ProductType = "1")
     
    Mark
    --
    Mark Heitbrink - MVP Group Policy - Cloud and Datacenter Management
     
    Homepage:  http://www.gruppenrichtlinien.de - deutsch
     
    Thursday, October 27, 2016 2:28 PM
  • > suggested. However, since it works fine for Windows 2008 R2 and 2012 R2
     > select * from Win32_OperatingSystem where Version like "10.%" or (
     > Version like "6.%" and ProductType = "1" )
     
    2012 reports version 6.3 so it matches the query in () - and then
    producttype kicks in which does not match 1 for a server and the filter
    evaluates to false.
     
    2016 reports version 10.x so it matches the first query, and now the
    filter is immediately true.
     
    Thursday, October 27, 2016 3:17 PM
  • Ah - I understand now.  It is working for the other OS types basically because of that I had 10.x first in the existing query.  So I just got lucky...

    Thanks for the help and clarification

    NK

    Thursday, October 27, 2016 4:01 PM