User GPO Win 7 and 10 in same OU

[ITGURU]

How do i create a GPO that will apply user settings to just computers that are on windows 10? Do i need to use some kind of WMI filtering or security filtering?

Is it possible to link Windows 10 policies to the same OUs that have windows 7 policies on or is it required to have them separate?

If you apply all GPOs to an OU will 7 specific ones apply to 7 and 10 specific ones to 10?

I've tried creating user and computer policies which work is i put a users in a new OU, assing the user GPO, and computers in a computer GPO and assign the Computer GPO.

 

However i need users to access both OS's each with the different policies..

 

Windows 7 will use existing User and Computer Policies, users that use Windows 7 will get the 10 policies. I can separate the computers into different OU's and get the computer settings to work but on the user OU's i need to put both Windows 7 and 10 policies so that depending which OS they log on to they will get the correct user settings.

 

Whats the best way to do this?

[forkies]

In Group Policy management, expand the domain, under WMI filtering you want to create one call it “Windows 10” and enter query [select * from Win32_OperatingSystem where Version like "10.%" and ProductType=1] which should only return Windows 10 client os.

 

Then under each GP object, just clicking on it in the tree, you should see the WMI drop down at the bottom. Select it there for your windows 10 gpos.

 

I would recommend you then filter the existing gpos to not apply to windows 10.

[Steve21]

Basically then just use wmi then double up the policies

 

While you can have some policies affect both (say office as it's same on 7 or 10), I find it's better to have them as separate ones to easily manage it and tweak any settings you need for one os

 

At the very basic level you'd end up with

 

User ou

Win7- user policy

Win10- user policy

 

Comp ou

Win7- comp policy

Win10- comp policy

[ITGURU]

In Group Policy management, expand the domain, under WMI filtering you want to create one call it “Windows 10” and enter query [select * from Win32_OperatingSystem where Version like "10.%" and ProductType=1] which should only return Windows 10 client os.

 

Then under each GP object, just clicking on it in the tree, you should see the WMI drop down at the bottom. Select it there for your windows 10 gpos.

 

I would recommend you then filter the existing gpos to not apply to windows 10.

 

Do I need to add anything extra to the query for 64 bit version?

[FN-GM]

Yes you use WMI filter. When we had a mixed estate we had both Windows 7 & Windows 10 policies on the same OU for computers and users. WMI filters made it so the policies only applied to the correct OS and there wasn't any cross communication.

 

These WMI filters should work:

 

 

Windows 10:

 

SELECT Version,ProductType FROM Win32_OperatingSystem WHERE Version LIKE "10.%" AND ProductType="1"

 

Windows 7:

 

select * from Win32_OperatingSystem where Version like "6.1%" and ProductType = "1"

 

- - - Updated - - -

 

Do I need to add anything extra to the query for 64 bit version?

 

Nope nothing :-)

[ITGURU]

If I then need to target different policies for Staff and Student how would I do this What settings do I need for the security filtering/delegation?

[ITGURU]

Yes you use WMI filter. When we had a mixed estate we had both Windows 7 & Windows 10 policies on the same OU for computers and users. WMI filters made it so the policies only applied to the correct OS and there wasn't any cross communication.

 

These WMI filters should work:

 

 

Windows 10:

 

SELECT Version,ProductType FROM Win32_OperatingSystem WHERE Version LIKE "10.%" AND ProductType="1"

 

Windows 7:

 

select * from Win32_OperatingSystem where Version like "6.1%" and ProductType = "1"

 

- - - Updated - - -

 

 

 

Nope nothing :-)

 

Thanks - must be why it wasn't working before as I found forums online saying to add 64 bit! Seems to be working now for all users that logon to test. 7 unaffected.

Now I just need to know how to link a staff and a student policy to the computer OU so it filters based on which type of user is logged on if you can help please?

[Liam]

I’m using wmi now for build types in the same way- works great for those split / testing environments

[FN-GM]

Now I just need to know how to link a staff and a student policy to the computer OU so it filters based on which type of user is logged on if you can help please?

 

I am not sure what you mean? What are you trying to achieve?

[Steve21]

If I then need to target different policies for Staff and Student how would I do this What settings do I need for the security filtering/delegation?

 

You just use the security filtering yep, just remember to re-add Auth users to the delegation tab if you're doing that

 

Steve

[ITGURU]

You just use the security filtering yep, just remember to re-add Auth users to the delegation tab if you're doing that

 

Steve

 

If I have both Authenticated users and the security group set, does Authenticated users have to have different settings to the security group, i.e Allow Read but not Apply Group Policy ?

[Steve21]

You need to put auth on delegation, not security As per above!

 

So "all staff" etc goes on security, auth goes on delegation for read etc (default one on dropdown)

 

Steve

[ITGURU]

You need to put auth on delegation, not security As per above!

 

So "all staff" etc goes on security, auth goes on delegation for read etc (default one on dropdown)

 

Steve

 

So on Delegation tab I have Authenticated uses with BOTH Read and Apply Group Policy - is that correct?

 

On Security, I add in the 'staff' group so it only applies to staff users, but does that need both Read and Apply group Policy options ticked too?

[Steve21]

You shouldn't need to use the advanced button, just go add and use the default dropdown as above

 

Read is the default, and in your scenario all staff should get Read (from security filtering) as default when you add them into security

 

Steve

[Julian]

Googling on WMI filters, shows that the general recomendatiom is to avoid if possible, as they can slow logons. For computers a new OU, (block inhertance) can solve the issue. For users, WMI filters are necessary, but some filters are slower than others.

 

Please see links below about speed of WMI filtres

https://helgeklein.com/blog/2016/01/how-group-policy-impacts-logon-performance-3-wmi-filters-ilt/

https://deploywindows.com/2016/02/15/using-group-policy-wmi-filters-computers-booting-slow/

[ITGURU]

Googling on WMI filters, shows that the general recomendatiom is to avoid if possible, as they can slow logons. For computers a new OU, (block inhertance) can solve the issue. For users, WMI filters are necessary, but some filters are slower than others.

 

Please see links below about speed of WMI filtres

https://helgeklein.com/blog/2016/01/how-group-policy-impacts-logon-performance-3-wmi-filters-ilt/

https://deploywindows.com/2016/02/15/using-group-policy-wmi-filters-computers-booting-slow/

 

The computer side is not an issue with having a new OU.

it's the user side, as need to keep all users in existing OUs but have different policies for widows 7 and windows 10 pcs so looking for the best way to do this.