0

I'm building a group policy to apply to a subset of users within my organization. This subset of users have no Home Directory set on their Active Directory object, whereas other users have an I:\ drive assigned.

I need to find a WMI query which will allow the User Configuration GPO to apply to a user with no I:\ drive.

I can easily find the inverse of that:

Select * From Win32_LogicalDisk Where DeviceID = 'I:'

But if I make this WHERE DeviceID <> 'I:\', it returns C:, D: and other mapped drives.

I thought about querying the user profile with something like this:

select RoamingPath from Win32_UserProfile where RoamingPath <> '\\*'

however that returns many results for system accounts and local administrator profiles, rather than the logged on user.

I've read that it is possible to query AD directly, but the command below gives me an "Invalid Class" error and I don't know if it would apply to the logged in user:

select * from ds_user where ADSIPath = LDAP://OU=CA,DC=global,DC=opus AND DS_homeDirectory=’*’

I think ideally this would be solved by using Win32_LogicalDisk to count the total number of drives, a second query to get a count of I:\ drives (either 1 or 0), and then subtract the second result from the first. If the result is = the first query, I have my set of users. So far no luck on finding syntax to do this within a GPO wmi filter though.

Improve this question
2
  • 1
    Would you consider using PowerShell instead? You could do this in about two lines with powershell and the ActiveDirectory module.
    – Yanick Girouard
    May 7, 2016 at 0:52
  • I'd certainly consider PowerShell, although i don't know how it could be used as a filter to which users the GPO applies to.
    – Jeff Miles
    May 7, 2016 at 22:34

1 Answer 1

Reset to default
0

I have determined that do accomplish this exactly as I've defined in my question is not really possible.

The two best options I have come across are:

  1. Inverted WMI Filters - Create an environment variable per user/PC which produces a result based on required logic. Then use a regular WMI query to filter on that environment variable.
  2. Scheduled PowerShell query - as Yanick suggested in the comments, create a PowerShell query which filters users based on required logic (i.e. homeDrive attribute being empty) and then add these user accounts into a group, which can then be used for Security Filtering on the GPO. This PowerShell is then scheduled on a LAN server to run repeatedly.

I've chosen option #2 in my environment.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .