WMI filters for Group Policy Processing.

[kennysarmy]

I currently have the following WMI filters in place in Group Policy Management.

 

For Windows 10 devices still running 1607 LTSB (wish we are slowly reducing numbers of)

SELECT * FROM Win32_OperatingSystem WHERE BuildNumber = "14393" AND ProductType = "1"

 

 

For Windows 10 devices running 1903 EDU

select * from Win32_OperatingSystem WHERE Version like "10.0.18362%" AND ProductType="1" AND OSArchitecture = "64-bit"

 

 

I use the WMI filters to give different desktops to the two versions, in 1607 we have lots of legacy software shortcuts on the desktop, different WSUS settings and different lockdown policies applied.

 

I now want to run some tests on a later version of Windows 10, but it will be close enough to 1903 EDU that it can run all the same GPO's.

 

Can anyone help me edit the WMI code so that it works if the version is 10.0.18362 and later?

 

Thanks.

[psydii]

If you've *only* got 1607 or 1903 and later, maybe the logic to catch "1903 and later" needs to be "where the build number is not 14393"

[kennysarmy]

If you've *only* got 1607 or 1903 and later, maybe the logic to catch "1903 and later" needs to be "where the build number is not 14393"

 

Sometimes you can't see the wood for the trees - thanks

[kennysarmy]

Might go with this:

 

SELECT * FROM Win32_OperatingSystem WHERE BuildNumber >= "15063" AND ProductType = "1"

[kennysarmy]

Does anyone know if it's possible to run WMI filters in powershell against the PC's in AD to check the results of the filter?

[psydii]

Don't think that is possible. Do you have SCCM/ MECM? Query based collections are built using with the data from WMI on the clients - so if you built the equivalent query for an appropriately scoped collection, you would hit the same devices with an appropriately scoped GPO WMI filter.

[computer_expert]

This article seems to suggest you can test a GPO WMI filter both locally and against a remote PC via powershell.