Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to write a WMI filter to prevent a GPO from applying to certain users

SELECT * from Win32_ComputerSystem WHERE NOT UserName LIKE 'domain\\user1_%' AND NOT UserName LIKE 'domain\\user2_%'

This works correctly if the user is logged onto the console but always returns false if the user is logged on via RDP.



There does seem to be a way to achieve this, it's described in method two of this article. Though, I am unsure of how to construct the query using Win32_Process?

share|improve this question
Is the user logging into the same computer in both cases? – joeqwerty Nov 29 '12 at 13:42
Under normal circumstances, yes. But it must work universally. – user135173 Nov 29 '12 at 21:32
Is there anyone out there that could possibly shed some light on this issue? – user135173 Dec 4 '12 at 17:33
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out. – joeqwerty Dec 4 '12 at 18:02

Don't use a WMI filter for that. Use an Access Control Entry for "Apply Group Policy" permission on the GPO object to specify a group for which the GPO should be applied/denied. You would also need to ensure that loopback policy processing is enabled.

share|improve this answer
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare. – user135173 Nov 29 '12 at 21:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.