Security Filtering and WMI Filtering

Security Filtering and WMI Filtering

Security Filtering is used to apply policy settings to only a particular set of users and computers. By default, all authenticated users will receive the policy settings. To apply the GPO only to a particular set of users and computers, follow these steps:

  • In the left pane of the GPMC snap-in, browse to the container and select the GPO
  • In the right pane, select the Scope Tab. Under the Security Filtering section, select Authenticated Users and click Remove
  • Now click Add to add the security principals to which the policy settings will be applied

Windows Management Instrumentation (WMI) filtering is used to apply GPOs based on certain properties of the target computer. WMI filters can be created based on the target computer’s make, model, operating system, time zone, etc. The following steps illustrate how to create a WMI filter:

  • In the left pane of GPMC, browse to the WMI filters container
  • Right-click the WMI filters container and select New
  • In the New WMI filter dialog box, enter the name and description of the filter. Click Add to enter the WMI query.

For example, the following query filters out computers based on their operating system: “Select * from Win32_OperatingSystem where Caption = “Microsoft Windows XP Professional”. Click Save

  • Now choose the GPO for which the WMI filter has to be applied
  • In the right pane, select the Scope Tab. Under the WMI Filtering section, choose the WMI filter from the drop down list and click Yes in the confirmation box that appears

Now, the GPO will be applied to only the computers running the Windows XP Professional operating system.

    • Related Articles

    • How to Create a Process Using WMI and PowerShell

      Introduction Windows Management Instrumentation (WMI) is a core Windows management technology; you can use it to manage both local and remote computers. PowerShell, a powerful scripting environment and command-line shell, can interact with WMI to ...

    • PowerShell: Configuring ASR to Block Processes from PSExec and WMI

      Attack Surface Reduction (ASR) rules in Windows Defender provide an effective way to enhance security by controlling potentially harmful actions. This tutorial focuses on using PowerShell to configure ASR rules, specifically to block process ...

    • Filtering Objects with PowerShell Where-Object command

      Microsoft PowerShell is a powerful tool that can help you automate tasks and streamline your workflow. One of the most useful features of Windows PowerShell is its Where-Object command, which allows you to filter data based on specific criteria. In ...

    • How to Monitor Active Directory Security Group Membership Changes

      How to Detect Security Group Membership Changes It is a recommended security practice for administrators to keep track of membership changes made to security groups. If this event is not tracked, an attacker might join a security-enabled group and ...

    • Active Directory Security Baseline: Explained

      Every business organization is different from one another. They serve their customers differently, their end users behave differently, and ultimately, the way that the organization handles cyber threat is vastly different from one another. Healthcare ...