Source
r/sysadmin•
bart2019

Windows Active Directory: Does WMI filtering on a GPO run on server or on client?

Question

We only want to apply a group policy (for WSUS) only to computers that are in the local network, or connected through VPN. It's possible to filter out those computers through a WMI filter.

This article says:

When the client processes such a group policy, Windows will check its state for compliance with the specified WMI query, and if the filter conditions are met, the GPO will be applied to this computer.

This "Windows" in this sentence, is that the client or the server? Does the WMI filter actually run on the client or the server? Thus, will the filter work when a laptop isn't connected to the VPN or local network, and the computer cannot reach the domain server?

Posted Feb 2, 2021, 11:19 AM UTC

110
uniitdude•

Client. If a pc can’t reach the domain controller then group policy won’t be applying anyway

3
joeykins82Windows Admin•

It runs locally on the client. Offline systems cache policy settings including relevant WMI filters (or if no cached objects are available they continue to run off the last successfully applied policy settings until instructed otherwise).

3
artifex78•

GPO's are just mandatory settings (registry and such). Once the GPO is applied it stays active.

In your case, a remote client needs access to the DC at least once via VPN/LAN. WMI filters are client-sided AFAIK.

1
JohnWickBOFH (┛ಠ_ಠ)┛彡┻━┻ GET OFF MY LAWN•

Think it through.

WMI is a local database each PC has of configuration information.

What does a server-side query accomplish? Not a whole lot.

1
waelder_at•

On, client. But its a bad idea only do it if you really hsve to...

1
HighanDry88•

Can you elaborate why WMI filtering is a bad idea? Just curious because our new system administrator changed our methods of group policy to apply based on WMI for certain instances.

1
waelder_at•

What you can do, should do and should NOT do with GPOs: WMI filter (evilgpo.blogspot.com)

How to NOT Use Win32_Product in Group Policy Filtering – TheWindowsUpdate.com

How Group Policy Impacts Logon Performance #3: WMI Filters & ILT • Helge Klein

​

Basically, if you care about login performance, and you do not have time to test and measure the stuff you should leave wmi filter alone. A Lot of stuff can be done in other ways faster.

Also the wmi database thends to fuck up, not so much like it has in XP, but its still a issue. If you dont believe ask an expierence SCCM administrator. They have tools to wipe and recreate the stuff on the fly for a reason.

1
HighanDry88•

ah ok thanks for the explanation. He is doing it to filter out what should go to our internal wsus server (onsite only desktops) and external will be our ext wsus telling client to get updates from microsoft ( so we don't tax our VPN too much)

​

He uses wmi filtering for subnets to tell the machine if it has this ip go to this server etc. Is there a better way in this instance?

1
waelder_at•

You can target the gpo at ad sites.

1
TinyWightSpider•

On the client, during login, prior to the end user being able to click anything.

Use them sparingly, as some queries end up taking a long time to run and make “applying GPO” last forever while the end user is forced to wait.

1