Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to apply a GPO in such a way that all the users in the domain whose department is "catering" should get affected by it. Should I use WMI filtering or is there any other way to filter like this.

And I used this query to filter -- select * from Win32_ComputerSystem where department='catering'

share|improve this question
You asked: "Should i use WMI filtering or is there any other way to filter like this." And you've had several answers saying that you shouldn't use WMI and you should use security groups. I'm not sure why you are so stuck on WMI still.. – Rex Jun 27 '13 at 14:26

Catering sounds like a nice easy way to group machines / users, so in this instance, I would suggest that it would be much more transparent and maintainable to apply this to a Catering OU (Or OU's) or a Catering security group.

Leave WMI filters for when you have no choice. In my experience, they're rarely used because there is generally a better way forward.

share|improve this answer
I cannot shift all the users to the OU or add them to another group. So I am choosing WMI filtering. Please provide me the syntax for doing it – user2010392 Jun 27 '13 at 13:00
Why can't you add them to a security group? This is how Microsoft recommends you do it. You clearly asked if there is a better way and I'm telling you the right way(s). – Dan Jun 27 '13 at 13:02
ServerFault (and StackExchange) are not for "please provide teh codez" questions. – tombull89 Jun 27 '13 at 13:03
I cannot add all the created users to that group. Also I have to add all the users that i m gonna create to the group. SO querying seems much easier for me – user2010392 Jun 27 '13 at 13:04
No, it's terrible - just add the users to the group. It's not a complicated process and it's how all other organisations manage it. It doesn't matter if you have thousands of users in that group, it's fine. – Dan Jun 27 '13 at 13:06

I'm not a programmer so don't take what I say below as gospel, you should check over at SO if you want confirmation, but I can't find a single WMI property for department that you can use to filter off of:

enter image description here

The CLOSEST I can find in the WMI namespace are the Win32_NetworkLoginProfile or Win32_UserAccount but they don't have a DEPARTMENT property in its class.

IF your GPO is using GPPs you can set up an LDAP query and do selective GPP targeting using that query:

Other than that...Dan's choice works.

share|improve this answer
Me too din't find anything ! – user2010392 Jun 27 '13 at 14:02
Edited my answer... – TheCleaner Jun 27 '13 at 14:16
+1 for the LDAP query on GPP - forgot about those.. – Rex Jun 27 '13 at 14:19
How to use those LDA queries in the Gpo. Could you please explain Rex. Where to give that query? – user2010392 Jun 27 '13 at 14:48
Does the GPO use GPPs to apply the settings you are talking about? If not, then it can't be used. If so, then look here on how to use and… and then open a new question if you can't get it working with details on the GPO/GPP and what you tried. – TheCleaner Jun 27 '13 at 14:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.