Using WMI filter with GPO to only apply to specific OU

[Sokh]

I've got a group policy that adds printers during logon which I've put under students so each time a student logs on it maps the printers. That part all works fine.

 

Where I'm running into trouble is using an WMI filter so it only applies to certain machines. Basically I want to create a GPO for each department so that where ever a student logs on it will only apply that departments GPO and only that departments printers are mapped. At the moment I'm just testing it with the art department. The structure is Domain.local/Workstations-Win7/Expressive arts/Art, so I'm using a WMI filter with namespace: root\directory\LDAP and query: SELECT * FROM ds_computer WHERE DS_distinguishedName like '%OU=ART,OU=Expressive Arts,OU=Workstations-Win7%'

 

When I test that with wbemtest.exe it only pulls up the computers in that OU but when I create the WMI filter and apply it to the GPO, gpresult shows that it gets a true result wherever I log on. I've tinkered with it but it always either shows true or false where ever I log on.

 

I hope that made sense, in truth I've only looked into WMI filters the last couple days so I may have something wrong somewhere. Any input or pointing out of a glaring mistake would be greatly appreciated, cheers!

[SovietRussia]

I've got a group policy that adds printers during logon which I've put under students so each time a student logs on it maps the printers. That part all works fine.

 

Where I'm running into trouble is using an WMI filter so it only applies to certain machines. Basically I want to create a GPO for each department so that where ever a student logs on it will only apply that departments GPO and only that departments printers are mapped. At the moment I'm just testing it with the art department. The structure is Domain.local/Workstations-Win7/Expressive arts/Art, so I'm using a WMI filter with namespace: root\directory\LDAP and query: SELECT * FROM ds_computer WHERE DS_distinguishedName like '%OU=ART,OU=Expressive Arts,OU=Workstations-Win7%'

 

When I test that with wbemtest.exe it only pulls up the computers in that OU but when I create the WMI filter and apply it to the GPO, gpresult shows that it gets a true result wherever I log on. I've tinkered with it but it always either shows true or false where ever I log on.

 

I hope that made sense, in truth I've only looked into WMI filters the last couple days so I may have something wrong somewhere. Any input or pointing out of a glaring mistake would be greatly appreciated, cheers!

 

Cant you just put the GPO in the OU... No need for WMI filters?

[Sokh]

If the OU only contains computers, which it does, it will only run computer policies which doesn't include logon scripts unfortunately. So if I put the printer mapping GPO in the Art OU it won't run the user part that contains the logon script. At least that's how I understand it, I could be wrong so feel free to point correct me.

[free780]

Unless you turn on loopback processing in merge mode.

[3s-gtech]

He's right - you can run logon scripts via GPOs set on Computer objects. The difficult comes when doing the reverse - startup scripts on User objects (which needs loopback processing). You should be fine just applying by OU - I have a large number of User settings set on Computers.

[Sokh]

That's a helluva lot simpler than what I was trying! I think I read something about it earlier and just totally missed what it did.

 

Thanks very much to both of you.

[apeman]

Using too many GP's and WMI Filters can cause a massive performance impact, it is also a management overhead having lots of GP's to keep track of.

Depending on how you name your computers could you maybe add some logic to your script??

 

i.e. If computer name contains room1 then map this printer else if computer name contains room2 then map this other printer etc

 

This has the advantage of being one script applied at logon and in only one gp with no wmi so easier to manage.

[Sokh]

I've just started here and looking at improving some of the aspects of the network. One of the things is exactly what you've mentioned, they have a staggering amount of GP running which is causing slow start up and login. There's a VBscript that runs every startup that creates a txt with all the printers, and a staff and student desktop and start menu. Then on logon there's another VBscript that adds printers based on that txt file.

 

It seemed an incredibly verbose way of doing it so I'm trying to slim it down one step at a time. I'll definitely look into the "all-in-one" script method though.

[Arcath]

https://gist.github.com/Arcath/1438247 << A script that lets you set printers based on the lowest ou the computer is in which runs as a user logon script.

 

I've not used it in a while (since moving to GPP) but it should work no problem