none
WMI Filter Option Missing from GPMC

    Question

  • 

    I am trying to create WMI Filters on a Server 2008 R2 domain that needs a WMI filter as part of its implementation but it seems the option to apply a WMI filter isn't showing in GPMC.

    I have checked the permissions and examined the AD folder under /System/WMIPolicy/SOM. I am opening GPMC as the domain administrator and as my domain admin user account. Both have the same results. I have attempted to open GPMC from each of the server 2008 R2 domain controllers and have the same result. I have tried opening GPMC on my Windows 10 machine using RSAT tools, same results. I have also tried changing the views in GPMC by un-checking and re-checking WMI Filters.

    The Forest and Domain Functional Levels are set to Server 2008 R2.

    I just started my job on this domain and dont know the full details on how it has been upgraded from previous function levels.

    I will attach a screenshot as soon as technet verifies my account.


    Tuesday, August 2, 2016 5:40 PM

Answers

  • I finally solve the issue after 2 months of no luck. I created a test VM server 2008 r2 matching my current DC. I then built a test domain. I examined the /SYSTEM/WMIPolicy/ container and noticed i was missing 3 containers (PolicyTemplate, PolicyType, WMIGPO). I also looked under /System/DomainUpdates/ and found I was missing the Windows2003Update container as well. Immediately after creating the containers the WMIFilters feature appeared within GPMC.
    • Marked as answer by Nwillia09 Wednesday, October 12, 2016 7:20 PM
    Wednesday, October 12, 2016 7:20 PM

All replies

  • Hi,

    Thanks for your post.

    First, I suggest you check the AD DS and LDS Tools on your server.

    The path: Server Manager -> Roles & Features -> Features -> RSAT -> AD DS and LDS Tools

    If there are some features are missed, you could try to install them first.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, August 3, 2016 6:51 AM
    Moderator
  • > I will attach a screenshot as soon as technet verifies my account.
     
    This would help greatly - I've never seen the WMI filter node or the WMI
    filter option for a single GPO missing in GPMC...
     
    Wednesday, August 3, 2016 2:12 PM
  • > I will attach a screenshot as soon as technet verifies my account.
     
    This would help greatly - I've never seen the WMI filter node or the WMI
    filter option for a single GPO missing in GPMC...
     

    Wednesday, August 3, 2016 2:26 PM
  • > I have checked the permissions and examined the AD folder under
    > /System/WMIPolicy/SOM. I am opening GPMC as the domain administrator and
     
    Stumped... Never seen before. Whhat does the SOM folder look like?
    Anything in there? And did you also check ACLs for both SOM and WMIPolicy?
     
    Wednesday, August 3, 2016 3:14 PM
  • The SOM folder is empty which tells me that no WMI Filters have ever been created. 

    Permissions for WMI &SOM folder:

    EVERYONE:Deny Deletion

    Creator Owner:Special

    Authenticated Users: Read

    System: Read

    Domain Admins: Full Control

    Enterprise Admins: Full Control

    GP Creator Owners: Read,Write,Create

    Administrators: Read,Write,Create

    Wednesday, August 3, 2016 3:41 PM
  • Hi,

    Have you check the AD DS tool in your DC?

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, August 4, 2016 12:41 PM
    Moderator
  • > EVERYONE:Deny Deletion
     
    That's incorrect - seems someone pushed down toplevel ACLs... :-() This
    entry is not present in a default installation. How about inheritance?
     
    > Authenticated Users: Read
     
    That's incorrect too - should be Special...
     
    I leave it up to you to setup a naked DC (contoso? :-) ) and restore the
    default ACLs - I have no script or something else to offer that will set
    them.
     
     
    Thursday, August 4, 2016 1:59 PM
  • Hi,

    Have you check the AD DS tool in your DC?

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    I have attached an image showing what is currently enabled on the PDC. There are 2 DCs running on the domain.

    Thursday, August 4, 2016 2:40 PM
  • > EVERYONE:Deny Deletion
     
    That's incorrect - seems someone pushed down toplevel ACLs... :-() This
    entry is not present in a default installation. How about inheritance?
     
    > Authenticated Users: Read
     
    That's incorrect too - should be Special...
     
    I leave it up to you to setup a naked DC (contoso? :-) ) and restore the
    default ACLs - I have no script or something else to offer that will set
    them.
     
     
    The Everyone:Deny comes from the accidental deletion protection check box and the Authenticated Users:is Read/Special. I dont think either of these are wrong but I will compare it with another domain later today.
    • Edited by Nwillia09 Thursday, August 4, 2016 8:57 PM
    Thursday, August 4, 2016 8:57 PM
  • Could this discussion contain any useful hint?

    https://social.technet.microsoft.com/Forums/en-US/4e3be07a-25ea-4426-983c-6a02755e8d9b/wmi-filters-folder-is-missing-from-the-group-policy-management?forum=smallbusinessserver

    In case it's useful, related to the above *possible* hint, I found this:
    http://thelazyadmin.com/2005/09/run-and-verify-adprep/

    NB: entirely possible I am on the wrong track, but worth a check?


    Don [doesn't work for MSFT, and they're probably glad about that ;]


    • Edited by DonPick Thursday, August 4, 2016 9:29 PM
    Thursday, August 4, 2016 9:19 PM
  • Could this discussion contain any useful hint?

    https://social.technet.microsoft.com/Forums/en-US/4e3be07a-25ea-4426-983c-6a02755e8d9b/wmi-filters-folder-is-missing-from-the-group-policy-management?forum=smallbusinessserver

    In case it's useful, related to the above *possible* hint, I found this:
    http://thelazyadmin.com/2005/09/run-and-verify-adprep/

    NB: entirely possible I am on the wrong track, but worth a check?


    Don [doesn't work for MSFT, and they're probably glad about that ;]


    I checked the revision and objectversions in ADSI edit and compared it to Server 2008 R2 numbers found online. As far as I can tell everything appears to be correct. My coworker claims the domain was freshly built starting at 2003. However I have no actual proof that it was not upgraded from 2000 or SBS.


    Monday, August 8, 2016 2:55 PM
  • Hi,

    I have searched a lot. but I have not found any helpful information for you.

    I will keep working on it.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, August 15, 2016 12:08 PM
    Moderator
  • I finally solve the issue after 2 months of no luck. I created a test VM server 2008 r2 matching my current DC. I then built a test domain. I examined the /SYSTEM/WMIPolicy/ container and noticed i was missing 3 containers (PolicyTemplate, PolicyType, WMIGPO). I also looked under /System/DomainUpdates/ and found I was missing the Windows2003Update container as well. Immediately after creating the containers the WMIFilters feature appeared within GPMC.
    • Marked as answer by Nwillia09 Wednesday, October 12, 2016 7:20 PM
    Wednesday, October 12, 2016 7:20 PM
  • Hi,

    Thanks for your share.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, October 13, 2016 12:49 AM
    Moderator