none
Multiple WMI Filters

    Question

  • Hi
    I'm trying to create two WMI queries for one WMI filter to apply to a GPO.
    As the GUI lets you do this I would assume its a valid operation.
    I have to create 2 queries as the namespace is different for each query.

    Query 1. Is OS Windows 10
       Root namespace = root\cimV2
    select Version, ProductType from Win32_OperatingSystem where Version like "10.%" and ProductType = "1"

    Query 2. Does the computer belong to this OU? "ou=Staff,dc=company,dc=co,dc=uk"
       Root namespace = root\RSOP\Computer
    Select * From RSOP_Session Where SOM like '%ou=Staff,dc=company,DC=co,dc=uk'

    I have both of these working on their own but when I add the two of them to the WMI editor (which allows you to do this) they don't work.

    So ...
    Q1. Is this allowed (I assume it is) Maybe it's not working because the namespace differs
    Q2. Does the GPO engine AND these two queries? I'd prefer to OR them if somehow possible.

    Any help most appreciated ....


    • Edited by Capric0rn1 Wednesday, April 27, 2016 4:02 PM
    Wednesday, April 27, 2016 4:00 PM

Answers

  • Hi,
     
    Am 27.04.2016 um 18:00 schrieb Geordie_Geoff:
    > I'm trying to create two WMI queries for one WMI filter to apply to a GPO.
     
    They will always use "AND" and both must be TRUE.
     
    Mark
    --
    Mark Heitbrink - MVP Windows Server - Group Policy
     
    GPO Tool: http://www.reg2xml.com - Registry Export File Converter
     
    • Marked as answer by Capric0rn1 Thursday, April 28, 2016 8:44 AM
    Wednesday, April 27, 2016 7:40 PM
  • Hi,
    As Mark said, the multiple WMI queries work in AND relationship.
    If you need an OR relationship of multiple queries, you may define more separate WMI filters. If you need to supply parallel conditions referencing different WMI classes, you will have to define different WMI filters and apply them to different GPOs. That would be to have the same policy settings configured in all the different GPOs while the different GPOs would apply to different computers.

    Regards,
    Wendy


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Capric0rn1 Thursday, April 28, 2016 8:30 AM
    Thursday, April 28, 2016 6:34 AM
    Moderator

All replies

  • Hi,
     
    Am 27.04.2016 um 18:00 schrieb Geordie_Geoff:
    > I'm trying to create two WMI queries for one WMI filter to apply to a GPO.
     
    They will always use "AND" and both must be TRUE.
     
    Mark
    --
    Mark Heitbrink - MVP Windows Server - Group Policy
     
    GPO Tool: http://www.reg2xml.com - Registry Export File Converter
     
    • Marked as answer by Capric0rn1 Thursday, April 28, 2016 8:44 AM
    Wednesday, April 27, 2016 7:40 PM
  • Hi,
    As Mark said, the multiple WMI queries work in AND relationship.
    If you need an OR relationship of multiple queries, you may define more separate WMI filters. If you need to supply parallel conditions referencing different WMI classes, you will have to define different WMI filters and apply them to different GPOs. That would be to have the same policy settings configured in all the different GPOs while the different GPOs would apply to different computers.

    Regards,
    Wendy


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Capric0rn1 Thursday, April 28, 2016 8:30 AM
    Thursday, April 28, 2016 6:34 AM
    Moderator
  • Thanks for the replies folks, always appreciated.

    Yeah I can see this is the case from my tests this morning. As you say I could create multiple GPO's with individual WMI filters.  I think GP loopback will be the answer here for the OU location query as it's not W10 dependent  and I'll use the Win 10 WMI filter + GPO for the other OU locations (OU subtrees are differet so no conflict between the two). 

    Geoff

    Thursday, April 28, 2016 8:42 AM
  •  If you need to supply parallel conditions referencing different WMI classes, you will have to define different WMI filters and apply them to different GPOs. That would be to have the same policy settings configured in all the different GPOs while the different GPOs would apply to different computers.

    ------------------------------------------

    Hello,

    Creating multiple policies is not solution of problem. Problem is that one computer need be compilant with both wmi filter queries when AND condition is used e.g. operating system is at least vista and TPM is present. I've checked that multiclass filters are working despite the "WMI filter tester" tool from http://www.gpoguy.com/FreeTools/FreeToolsLibrary/tabid/67/agentType/View/PropertyID/93/Default.aspx 

    is returning "invalid class" error.  

    My filter is:

    "root\CIMV2\Security\MicrosoftTpm;Select * from Win32_Tpm WHERE IsActivated_InitialValue <> null;root\CIMv2;Select * from Win32_Battery WHERE BatteryStatus <> 0"

    Tomek

    Wednesday, May 17, 2017 11:43 AM