Solved

WMI Filtering

Posted on 2013-01-08
10
1,340 Views
Last Modified: 2013-01-08
I have a mix of XP and windows 7 machines in my domain.  I have a screensaver (the same) for both the XP machines and Windows 7 machines it's using generic accounts to log in - the same account for both windows 7 and XP.  Obviously the exe is different for both machines so I created a wmi filter for windows 7 and for XP  (this is the filter for windows 7 -  - Select * from Win32_operatingSystem where Verions Like "6.1%" and ProductType="1")
This is the filter for XP (select * from Win32_OperatingSystem where Version like "5.1.%").  This issue is some of my Windows 7 machines the policy is being denied it says False WMI filter for both XP and Windows 7.  Can this be corrected? Lastly this is a wireless machine.  I thought that was the issue however the machine is picking up the other GPO's.
0
Comment
Question by:WellingtonIS
  • 6
  • 3
10 Comments
 
LVL 10

Expert Comment

by:ienaxxx
ID: 38754772
try running a script like this:

On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("select * from Win32_OperatingSystem")
For Each objItem in colItems
	Wscript.echo objItem.Version
	Wscript.echo objItem.BuildNumber
Next

Open in new window


if nothing goes wrong there is no reason for your filter to fail.
Otherwise if, probably, you get some error, you can investigate on that and find your solution...

Probably you have some problems on WMI on those machines. Something like WMI services not started or stuff like that.

double check registries for WMI errors and investigate in that direction.

HTH
0
 
LVL 14

Expert Comment

by:BlueCompute
ID: 38754833
Does running the group policy simulation give the expected results? And what do you see if you run
gpresult /H C:\gpresult.html
From an elevated command prompt to see the Group Policy results?
0
 

Author Comment

by:WellingtonIS
ID: 38754837
I ran the VBS script on machine returns the following:
Windows Script Host - 6.1.7601
Windows Script Host - 7601
I'm not sure where to go from here.  Also where are the entries for wmi in the registry?
0
 

Author Comment

by:WellingtonIS
ID: 38754858
When I ran Group Policy Results from GPM I got that error that the WRMS SSMYPICSWIN7 which is the GPO with the WMI filter was False WMI Filter it was denied. When I ran gpresult /H C:\gpresult.html its denied there too.
0
 
LVL 14

Expert Comment

by:BlueCompute
ID: 38755084
Can you post the gpresult.html file here please, or give us the full error text, as I don't recognize the error you've posted. A "false wmi filter" result just means the WMI Filter evaluated to false for the machine in question, rather than being an error in itself.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 

Author Comment

by:WellingtonIS
ID: 38755189
sure see attached... The GPO name is wrms ssmypicswin7
gpresult.html
0
 
LVL 14

Accepted Solution

by:
BlueCompute earned 500 total points
ID: 38755276
The one you just posted actually reads:

WRMS SSMYPICSXP	corp.uhsinc.biz/Acute Facilities/Wellington	Access Denied (Security Filtering)
WRMS SSMYPICSWIN7	corp.uhsinc.biz/Acute Facilities/Wellington	False WMI Filter

Open in new window

This implies you were running the gpresult on an XP machine (is that right?) which doesn't have access to the SSMYPICXP policy - it doesn't apply the WIN7 policy because the machine failed the WMI Filter (either 'cos the filter's not working properly or because the machine isn't Win7), and is unable to access the XP Policy due to security settings.
Are you sure you haven't maybe got the filters the wrong way round such that the security filtering on the group policy object doesn't match the WMI filter that's being used to select targets for it?
0
 

Author Comment

by:WellingtonIS
ID: 38755370
The Machine in question is a Windows 7 machine.  I have 2 Policies one for XP and one for Windows 7  however, the user accounts are the same because we use generic accounts so I used the WMI filter so distinguish between the XP machines and the Win 7 machines.  I thought that was the purpose of the WMI filter to distinguish between OS, hardware etc? Its working on some machines but not on all.
0
 

Author Comment

by:WellingtonIS
ID: 38755609
OK took your advice and changed my filter from 6.1 to just 6 and that seemed to work?  I'm not sure why considering it's a 32 bit windows 7 machine but I'll take it.
0
 

Author Closing Comment

by:WellingtonIS
ID: 38755805
OK took your advice and changed my filter from 6.1 to just 6 and that seemed to work?  I'm not sure why considering it's a 32 bit windows 7 machine but I'll take it.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

I hope this helps those who have been battling the SanDisk / U3 problem for a while. For anyone that is running Windows 7 64bit and is receiving and searching the internet for the “Windows Error: Windows has allocated a drive letter to the U3 dri…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
This Micro Tutorial will teach you how to the overview of Microsoft Security Essentials. This is a free anti-virus software that guards your PC against viruses, spyware, worms, and other malicious software. This will be demonstrated using Windows…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now