The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A WMI filter lets a Group Policy Object (GPO) apply only when a query matches the destination computer. Create the filter in Group Policy Management Console (GPMC), attach it to the GPO, and validate the result on representative computers. Use WMI for computer characteristics and exceptions—not as a substitute for security filtering when group membership should control access.
What a WMI filter does
A WMI filter is a query associated with a GPO. During Group Policy processing, the client evaluates the query on the destination computer: a true result allows that GPO to apply, and a false result excludes it. Microsoft documents one WMI filter per GPO, but the same filter can be reused by multiple GPOs. Microsoft’s Group Policy processing guidance describes this behavior.
As an Amazon Associate I earn from qualifying purchases.
Before creating the filter
- Install the Group Policy Management feature and open GPMC.
- Make sure your account has permission to edit the intended GPO. Linking a GPO to a site, domain, or OU also requires permission to modify that container. See Microsoft’s GPMC overview.
- Define the computer condition the query must identify, and confirm the relevant WMI namespace, class, properties, and values on the Windows versions in your environment.
How to create a WMI filter for a GPO
- In GPMC, expand the forest and domain, then select WMI Filters.
- Create a new filter. Give it a descriptive name that says what it tests and a description explaining why it exists.
- Add a query, specifying its namespace and query text. Save the filter.
- Select the GPO that should use the filter and choose the saved filter in the GPO’s WMI Filtering section.
- Review the GPO’s scope and security filtering, then test the configuration on representative computers.
Microsoft’s GPO processing documentation notes that an existing filter can be reused when it matches the new GPO’s requirement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Historical query example—and why to verify it
Microsoft’s legacy WMI filter procedure is labeled for Windows Server 2012 and was last updated September 5, 2016. It shows a query in the rootCIMv2 namespace against Win32_OperatingSystem to identify Windows 8 client systems:
#1 Best Overall
select * from Win32_OperatingSystem where Version like "6.2%" and ProductType="1"In that historical example, 6.2% is the Windows 8 version prefix and ProductType="1" identifies a client system. The same legacy guidance identifies ProductType 2 as a domain controller and 3 as a server that is not a domain controller. These are example values, not a current Windows release selector. Check the actual properties and values on your target operating systems before relying on a query; the cited documentation does not establish one query that is correct for every modern Windows client and server release.
Choose the right targeting mechanism
| Requirement | Mechanism | How it differs |
|---|---|---|
| Limit a GPO based on user or computer group membership and permissions | Security filtering | Uses permissions to refine which users or computers can apply the GPO. See Microsoft’s Group Policy scope guidance. |
| Apply a GPO only when a computer characteristic matches | WMI filter | The Group Policy client evaluates the query on the destination computer during policy processing. |
| Conditionally apply one Group Policy Preferences item | Item-level targeting | Places the condition on the preference item rather than filtering the whole GPO. Multiple conditions can be combined with AND or OR logic; see Microsoft’s Group Policy Preferences guidance. |
Microsoft’s legacy filtering guidance recommends WMI filters primarily for exception management. They are evaluated each time Group Policy is processed, may increase startup or logon time, and have no timeout. Microsoft does not quantify a universal delay, so the practical impact depends on the environment and query.
Refresh and verify policy
After changing a filter or its GPO, trigger policy processing with one of Microsoft’s documented options: gpupdate.exe, the Invoke-GPUpdate PowerShell cmdlet, or the GPMC Group Policy Update action for an OU. Then verify the outcome on representative target and non-target computers before wider deployment. See Microsoft’s Group Policy processing guidance.
Recommended Free Tools
Why a GPO with a WMI filter may not apply
Check the layers in order rather than assuming the query is the only possible cause:
- Confirm GPO scope. Check that the GPO is linked where the computer or user is in scope. Microsoft’s scope guidance explains how scope and filtering determine applicability.
- Check security filtering and permissions. Verify that the intended user or computer has the permissions needed for the GPO to apply.
- Check the WMI filter result on the destination computer. Confirm that the query uses the intended namespace, class, properties, and values and evaluates true for a computer that should receive the GPO. A false result excludes the GPO.
- Reconsider the targeting method if results or processing are unexpected. A group-based requirement may fit security filtering better; a condition for a single preference item may fit item-level targeting. A WMI filter has no timeout, so review whether its condition is necessary and straightforward.
Microsoft documents the filtering behavior and overhead, but does not provide one environment-independent diagnostic transcript; validate the particular GPO and query in your domain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
