Windows Management Interface (WMI) Filtering for Group Policy Objects

During my recent work with a local law firm overhauling their network and designing a new Active Directory (AD) domain structure I have learned some tricks. One is WMI Filtering for applying an entire Group Policy Object (GPO).

Windows Management Interface (WMI) Filtering is a feature in the Group Policy Management Console (GPMC) on Windows Server operating systems that let you create conditional logic as to whether or not a GPO applies to a specific computer within it's assigned Operational Unit (OU). Here's an example filter taken from the Security Baseline for Windows 10 (Draft):

Internet Explorer 11.mof
instance of MSFT_SomFilter
{
Author = "Administrator@JST4KXS.local";
ChangeDate = "20131215210840.077000-000";
CreationDate = "20131031204931.789000-000";
Description = "Applies Internet Explorer 11 Settings";
Domain = "JST4KXS.local";
ID = "{F78EB5A2-B8C0-49FC-BB29-86DD2D3E0B15}";
Name = "Internet Explorer 11";
Rules = {
instance of MSFT_Rule
{
Query = "SELECT * FROM CIM_Datafile WHERE Name = 'C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe' AND Version LIKE '11.%'";
QueryLanguage = "WQL";
TargetNameSpace = "root\\CIMv2";
}};
};

The first section, from Author to Name, can be mostly whatever you want if you plan on importing them into a new domain. The Name will appear in the drop-down menu at the bottom of settings screen for the GPO in the GPMC, and the description will appear if you go to the filter itself in the GPMC.

Below 'instance of MSFT_Rule' is a WMIC query. In this case it selects computers where internet explorer exists, and the Version of iexplorer.exe is like '11.%' It also specifies the query type, and the name space which is required for most WMIC queries.

When a workstation authenticates to AD and is going through the list of policies to apply, the Domain Controller (DC) will make a WMIC query to the workstation before deciding whether or not a GPO with this filter set should be applied. If the workstation returns TRUE ('Yes I have Internet Explorer 11 installed) then the GPO will apply.

Another WMI Filter that comes with the Security Baseline for Windows 10 (Draft) is this one:

Windows 10.mof
instance of MSFT_SomFilter
{
Author = "Administrator@JST4KXS.local";
ChangeDate = "20130627235040.542000-000";
CreationDate = "20130627233058.196000-000";
Description = "Applies Windows 10 Settings";
Domain = "JST4KXS.local";
ID = "{6EB48A2A-F3FF-462E-8A93-318A5466141E}";
Name = "Windows 10";
Rules = {
instance of MSFT_Rule
{
Query = "Select * from Win32_OperatingSystem WHERE Version LIKE \"10.0.%\" and ProductType = \"1\"";
QueryLanguage = "WQL";
TargetNameSpace = "root\\CIMv2";
}};
};

Again the part that matters here is the MSFT_Rule which selects computers where the Win32_OperatingSystem's Version property is like "10.0.%" and the ProductType property is "1\". If those two conditions are met then the GPO this filter is assigned to will apply the GPO.

My Thoughts

My first thought is that this would be useful for separating your GPOs by operating system version without having to create separate OUs for them. If your office runs multiple versions of Microsoft Office you may be able to use WMI filtering to only apply the correct GPO to the workstation because every version of Office whether it be 2010 or 2016 has two separate group policy templates: one for 64-bit and one for 32-bit. I plan on experimenting more with this feature in the future because it seems interesting.

Comments

Post a Comment

Popular posts from this blog

InfosecN00bs, Part 1: Press Release

Image
UPDATE 2017-07-29 This post previously stated that @BretMattingly was a member of the leadership of @InfosecN00bs. Just before Defcon BretMattingly stepped away from @InfosecN00bs for unstated reasons. After this blog post was originally published, he took the concerns to @Hacksforsnacks_ and @K_5m00th, who did not want to return funds raised, issue a statement regarding the matter, or take any corrective actions. The fundraiser was done under @Bretmattingly's name because he was being set up to be the fall guy for when everything toppled over. Original Post The twitter account @InfosecN00bs  has posted an official statement regarding their failed crowdfunding campaign after a few people publicly questioned where the money was being used.  The @InfosecN00bs group is run by @Hacksforsnacks_ , @K_5m00th . Official Statement: Part 1 Official Statement: Part 2 To be perfectly clear: This is a press release statement playing damage control. @InfosecN00bs...
Read more

On "Gaming" Social Media

Image
I begin this blog post with an acknowledgment of the irony of the situation. But I'm taking the opportunity use this chance to highlight the social media snowball and how to use your momentum responsibly. This post is in no way an indictment of MalwareTechBlog, nor am I implying that they did anything wrong here . If I come across as petty it is intentional and not sincere. On May 26th, 2017, I tweeted about a bug with Microsoft Office in which a background task would flicker a command prompt briefly due to it being mistakenly registered as a user-context task. First! Thirty-seven hours later the Savior of the Internet, Slayer of Wcry, MalwareTechBlog posted a tweet that said basically the same thing . With no significant additional information. Second, more popular mouse gets the cheese Social media is all about visibility. After MalwareTech posted their tweet SwiftonSecurity retweeted it, and between both of their substantial platforms a very visible conversation ...
Read more

InfosecN00bs, Part 2: Fixing the Problem

This is a rather difficult post because it is addressing problems in a group that does not want to listen to criticism of their behavior if it is conveyed with a tone and, thanks to @hacksforsnacks_'s experience in public relations, created a reputation that at first glance seems welcoming and supportive of all people. There are likely people who will come to defend the group but I have found, anecdotally, more people that have stepped forwards with complaints. In my previous post I broke down a press release statement posted by the @InfosecN00bs account to discern what the statement actually says. Here, I will speak about moderating online communities and then call out specific problems with the way that @InfosecN00bs has, and for each problem I discuss I will provide constructive and actionable solutions. Disclaimer : I do not have a good history with this group. I am highly critical of members of their leadership. I do, however, think that highly technical fields are b...
Read more