Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to write a WMI filter to prevent a GPO from applying to certain users

SELECT * from Win32_ComputerSystem WHERE NOT UserName LIKE 'domain\\user1_%' AND NOT UserName LIKE 'domain\\user2_%'

This works correctly if the user is logged onto the console but always returns false if the user is logged on via RDP.

Mark

EDIT:

There does seem to be a way to achieve this, it's described in method two of this article. Though, I am unsure of how to construct the query using Win32_Process?

share|improve this question
    
Is the user logging into the same computer in both cases? –  joeqwerty Nov 29 '12 at 13:42
    
Under normal circumstances, yes. But it must work universally. –  user135173 Nov 29 '12 at 21:32
    
Is there anyone out there that could possibly shed some light on this issue? –  user135173 Dec 4 '12 at 17:33
    
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out. –  joeqwerty Dec 4 '12 at 18:02
add comment

1 Answer 1

Don't use a WMI filter for that. Use an Access Control Entry for "Apply Group Policy" permission on the GPO object to specify a group for which the GPO should be applied/denied. You would also need to ensure that loopback policy processing is enabled.

share|improve this answer
    
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare. –  user135173 Nov 29 '12 at 21:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.