How can I restrict the application of Group Policy Object (GPOs) depending on the client machine's OS?

A. Windows Server 2003 introduced the ability to use a Windows Management Instrumentation (WMI) filter to control application of a linked GPO. WMI filters are applied only to Windows 2003 and Windows XP machines; other OSs ignore the filter and apply the GPO (you also need Windows 2003 domain controllers--DCs). Eventually, all machines will understand WMI filters, but until then, if you need different settings between, for example, Windows 2000 Server machines and XP machines, you need to create two GPOs, one that has the settings for Win2K Server machines and one containing settings for the XP machines. Make the Win2K Server GPO higher in priority and set the WMI policy for the Win2K Server GPO so that XP machines don't run it. This configuration means that the Win2K Server clients would run both policies, but the Win2K Server policy has a higher priority and will take precedence. The XP client won't run the Win2K Server policy because of the WMI filter. Instead it will run only the XP policy.

To create a WMI filter, perform these steps:

1. Access the properties of the GPO that requires a WMI filter. To do so, open the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in. Right-click Domain/OU, and select Properties. Select the Group Policy tab, select the GPO, and click Properties. You could also use Group Policy Management Console (GPMC) to create a WMI filter.
2. Select the WMI Filter tab in the GPO's properties.
3. In the "Select a WMI filter" section, select "This filter" and click Browse/Manage, as the figure shows.
4. At the Manage WMI Filters screen, click Advanced.
5. To add a new filter, click New, as the figure shows.
6. Enter a name and description for the new filter. In the Queries field, enter the WMI query. For example, to restrict the GPO to only XP machines, enter the following text, as the figure shows.

   Root\CimV2; Select * from Win32_OperatingSystem where Caption =
   "Microsoft Windows XP Professional"
   

7. Click Save.
8. Click OK to close the Manage WMI Filters dialog box.
9. Click OK to close the GPO properties dialog box.

You can determine whether the filter works by running the gpupdate command (to refresh the policy), then running the gpresult command. For example, on a non-XP machine, the gpresult command returns this output:

The following GPOs were not applied because they were filtered out.

-------------------------------------------------------------------
XPOnly
Filtering: Denied (WMI Filter)
WMI Filter: XPOnly
On an XP machine I see the policy was applied:
Applied Group Policy Objects
-----------------------------
Default Domain Policy
XPOnly

For more help with WMI, download the WMI administrative tools at http://www.microsoft.com/downloads/release.asp?releaseid=40804 .

End of Article