WMI Filter - Apply GPO if file does NOT exist

[petben]

Anyone got any ideas for a WMI filter to apply policy only if file does NOT exist?

[psydii]

WMI filters on GPO's are not a great idea if you need boots and logons to be reasonably swift. What is the GPO going to do? Perhaps there is another way of evaluating whether the computer needs to apply it?

 

EDIT

Depending on what you are trying to do, Group Policy Preferences with Item Level Targeting may be better?

/ EDIT

 

In a world with out GPP / ILT, I'd have done it this way:

 

A GPO with a script that fires on all computers and runs in the context of the computer at user logon (delayed start so it doesn't impact logon times), that adds the computer to a group if the file does not exist, and then the GPO filters by group membership.

 

You would need to give domain computers update/manage rights to the group.

 

This way may still be faster to execute at boot/logon on the devices that either WMI and ILT.

Edited March 14, 2022 by psydii

[petben]

I am using a wmi filter speed test and general OS/file queries are 10's of milliseconds

 

https://deploywindows.com/2016/02/15/using-group-policy-wmi-filters-computers-booting-slow/

 

we need a way of saying 'if file doesn't exist then apply the policy'. Unfortunately the policy settings are not item level target capable.

[psydii]

Then I would go for the two step process using group membership filtering. The script determines if the file doesn't exist and adds the computer to the group. On next boot or gpo update after a kerberos ticket refresh the group-filtered policy will apply. If you need it to fire immediately, you could force the Kerberos ticket and policy refresh in the script. Another script in your filtered GPO could remove the computer from the group if its a one-shot type of thing.