GPO WMI username filter not working over RDPWMI Filter in GPO by UserName/UseGroupHow to Apply GPO through WMI filteringBGInfo and WMI FilterWMI filter is ignored by certain clients in group policiesRemote Desktop: What is the difference between “Run these programs at logon” and “Start the following program on connection”?WMI query to find lack of drive letter for Group PolicyGPO WMI filter not excluding computersWMI-filter on GPO evaluates contradictoryWindows 10 Folder RedirectionImporting GPO WMI filter .mof file
Mount a folder with a space on Linux
How should I behave to assure my friends that I am not after their money?
How well known and how commonly used was Huffman coding in 1979?
Pull-up sequence accumulator counter
First-year PhD giving a talk among well-established researchers in the field
Are neural networks the wrong tool to solve this 2D platformer/shooter game? Is there a proven way to frame this problem to a neural network?
Does ultrasonic bath cleaning damage laboratory volumetric glassware calibration?
Was touching your nose a greeting in second millenium Mesopotamia?
Counting occurrence of words in table is slow
In the Marvel universe, can a human have a baby with any non-human?
Is this one of the engines from the 9/11 aircraft?
How to perform Login Authentication at the client-side?
How to determine what is the correct level of detail when modelling?
Averting Real Women Don’t Wear Dresses
A player is constantly pestering me about rules, what do I do as a DM?
When is it ok to add filler to a story?
Find smallest index that is identical to the value in an array
Does the UK have a written constitution?
What is this opening trap called, and how should I play afterwards? How can I refute the gambit, and play if I accept it?
Should my manager be aware of private LinkedIn approaches I receive? How to politely have this happen?
Why isn’t the tax system continuous rather than bracketed?
Why is the Turkish president's surname spelt in Russian as Эрдоган, with г?
Architecture of networked game engine
How risky is real estate?
GPO WMI username filter not working over RDP
WMI Filter in GPO by UserName/UseGroupHow to Apply GPO through WMI filteringBGInfo and WMI FilterWMI filter is ignored by certain clients in group policiesRemote Desktop: What is the difference between “Run these programs at logon” and “Start the following program on connection”?WMI query to find lack of drive letter for Group PolicyGPO WMI filter not excluding computersWMI-filter on GPO evaluates contradictoryWindows 10 Folder RedirectionImporting GPO WMI filter .mof file
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I'm trying to write a WMI filter to prevent a GPO from applying to certain users
SELECT * from Win32_ComputerSystem WHERE NOT UserName LIKE 'domain\user1_%' AND NOT UserName LIKE 'domain\user2_%'
This works correctly if the user is logged onto the console but always returns false if the user is logged on via RDP.
Mark
EDIT:
There does seem to be a way to achieve this, it's described in method two of this article. Though, I am unsure of how to construct the query using Win32_Process?
windows-server-2008 active-directory group-policy sql wmi
add a comment |
I'm trying to write a WMI filter to prevent a GPO from applying to certain users
SELECT * from Win32_ComputerSystem WHERE NOT UserName LIKE 'domain\user1_%' AND NOT UserName LIKE 'domain\user2_%'
This works correctly if the user is logged onto the console but always returns false if the user is logged on via RDP.
Mark
EDIT:
There does seem to be a way to achieve this, it's described in method two of this article. Though, I am unsure of how to construct the query using Win32_Process?
windows-server-2008 active-directory group-policy sql wmi
Is the user logging into the same computer in both cases?
– joeqwerty
Nov 29 '12 at 13:42
Under normal circumstances, yes. But it must work universally.
– user135173
Nov 29 '12 at 21:32
Is there anyone out there that could possibly shed some light on this issue?
– user135173
Dec 4 '12 at 17:33
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out.
– joeqwerty
Dec 4 '12 at 18:02
add a comment |
I'm trying to write a WMI filter to prevent a GPO from applying to certain users
SELECT * from Win32_ComputerSystem WHERE NOT UserName LIKE 'domain\user1_%' AND NOT UserName LIKE 'domain\user2_%'
This works correctly if the user is logged onto the console but always returns false if the user is logged on via RDP.
Mark
EDIT:
There does seem to be a way to achieve this, it's described in method two of this article. Though, I am unsure of how to construct the query using Win32_Process?
windows-server-2008 active-directory group-policy sql wmi
I'm trying to write a WMI filter to prevent a GPO from applying to certain users
SELECT * from Win32_ComputerSystem WHERE NOT UserName LIKE 'domain\user1_%' AND NOT UserName LIKE 'domain\user2_%'
This works correctly if the user is logged onto the console but always returns false if the user is logged on via RDP.
Mark
EDIT:
There does seem to be a way to achieve this, it's described in method two of this article. Though, I am unsure of how to construct the query using Win32_Process?
windows-server-2008 active-directory group-policy sql wmi
windows-server-2008 active-directory group-policy sql wmi
edited Nov 30 '12 at 18:15
asked Nov 29 '12 at 12:59
user135173
Is the user logging into the same computer in both cases?
– joeqwerty
Nov 29 '12 at 13:42
Under normal circumstances, yes. But it must work universally.
– user135173
Nov 29 '12 at 21:32
Is there anyone out there that could possibly shed some light on this issue?
– user135173
Dec 4 '12 at 17:33
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out.
– joeqwerty
Dec 4 '12 at 18:02
add a comment |
Is the user logging into the same computer in both cases?
– joeqwerty
Nov 29 '12 at 13:42
Under normal circumstances, yes. But it must work universally.
– user135173
Nov 29 '12 at 21:32
Is there anyone out there that could possibly shed some light on this issue?
– user135173
Dec 4 '12 at 17:33
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out.
– joeqwerty
Dec 4 '12 at 18:02
Is the user logging into the same computer in both cases?
– joeqwerty
Nov 29 '12 at 13:42
Is the user logging into the same computer in both cases?
– joeqwerty
Nov 29 '12 at 13:42
Under normal circumstances, yes. But it must work universally.
– user135173
Nov 29 '12 at 21:32
Under normal circumstances, yes. But it must work universally.
– user135173
Nov 29 '12 at 21:32
Is there anyone out there that could possibly shed some light on this issue?
– user135173
Dec 4 '12 at 17:33
Is there anyone out there that could possibly shed some light on this issue?
– user135173
Dec 4 '12 at 17:33
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out.
– joeqwerty
Dec 4 '12 at 18:02
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out.
– joeqwerty
Dec 4 '12 at 18:02
add a comment |
1 Answer
1
active
oldest
votes
Don't use a WMI filter for that. Use an Access Control Entry for "Apply Group Policy" permission on the GPO object to specify a group for which the GPO should be applied/denied. You would also need to ensure that loopback policy processing is enabled.
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare.
– user135173
Nov 29 '12 at 21:43
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f453427%2fgpo-wmi-username-filter-not-working-over-rdp%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Don't use a WMI filter for that. Use an Access Control Entry for "Apply Group Policy" permission on the GPO object to specify a group for which the GPO should be applied/denied. You would also need to ensure that loopback policy processing is enabled.
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare.
– user135173
Nov 29 '12 at 21:43
add a comment |
Don't use a WMI filter for that. Use an Access Control Entry for "Apply Group Policy" permission on the GPO object to specify a group for which the GPO should be applied/denied. You would also need to ensure that loopback policy processing is enabled.
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare.
– user135173
Nov 29 '12 at 21:43
add a comment |
Don't use a WMI filter for that. Use an Access Control Entry for "Apply Group Policy" permission on the GPO object to specify a group for which the GPO should be applied/denied. You would also need to ensure that loopback policy processing is enabled.
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
Don't use a WMI filter for that. Use an Access Control Entry for "Apply Group Policy" permission on the GPO object to specify a group for which the GPO should be applied/denied. You would also need to ensure that loopback policy processing is enabled.
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
answered Nov 29 '12 at 13:13
Greg AskewGreg Askew
29.4k3 gold badges38 silver badges70 bronze badges
29.4k3 gold badges38 silver badges70 bronze badges
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare.
– user135173
Nov 29 '12 at 21:43
add a comment |
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare.
– user135173
Nov 29 '12 at 21:43
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare.
– user135173
Nov 29 '12 at 21:43
Greg, I'm trying to avoid the use of Active Directory security groups and GPO security filtering/delegation. As you can see the WMI filter above uses wildcards - it will potentially be filtering out hundreds of different user accounts. Maintaining those users within their respective security groups would be a nightmare.
– user135173
Nov 29 '12 at 21:43
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f453427%2fgpo-wmi-username-filter-not-working-over-rdp%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Is the user logging into the same computer in both cases?
– joeqwerty
Nov 29 '12 at 13:42
Under normal circumstances, yes. But it must work universally.
– user135173
Nov 29 '12 at 21:32
Is there anyone out there that could possibly shed some light on this issue?
– user135173
Dec 4 '12 at 17:33
Try running gpresults against the computer and user when the user is logged on via RDP to see if anything stands out.
– joeqwerty
Dec 4 '12 at 18:02