<\/p>\n
The following screen shot shows the default set of GPO WMI Filters that I typically use.<\/p>\n
The following screen shot shows how they look from within the GPMC.<\/p>\n These particular WMI queries are not performance intensive, and therefore quick to process. However, it’s important to be careful how you construct them, as WMI is often known to be slow and inefficient. And of course a corrupt or inconsistent\u00a0WMI repository doesn’t help.<\/p>\n As always it is recommended to use a tool such as the WMI Filter Validation Utility<\/a> to ensure the WMI query is valid and efficient.<\/p>\n Here are the contents of the\u00a0DefaultWMIFilters.csv<\/a> file that can be used to create\u00a0the default set of filters I use.<\/p>\n Here is the ManageWMIFilters.ps1<\/a>\u00a0script:<\/p>\n Enjoy!<\/p>\n","protected":false},"excerpt":{"rendered":" This PowerShell script will Create, Import and Export Group Policy WMI Filters. I wrote this script to cover a number of different scenarios: To create a default set of GPO WMI Filters for new builds. To document existing WMI filters for health checks and audits. To provide a mechanism to migrate WMI filters between Dev, … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[202,60,5],"tags":[428,284,337,343,345,214,347,419,346,344,341,340,349,348,350],"class_list":["post-1354","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-group-policy","category-scripting","tag-active-directory","tag-ad","tag-adds","tag-create","tag-export","tag-gpo","tag-gpo-wmi-filters","tag-group-policy","tag-group-policy-wmi-filters","tag-import","tag-posh","tag-powershell","tag-som","tag-wmi-filters","tag-wmipolicy"],"aioseo_notices":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/1354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/comments?post=1354"}],"version-history":[{"count":7,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/1354\/revisions"}],"predecessor-version":[{"id":1365,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/1354\/revisions\/1365"}],"wp:attachment":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/media?parent=1354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/categories?post=1354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/tags?post=1354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Default](\"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-content\/uploads\/2014\/06\/Default-GPO-WMI-Filters.png\")
<\/a><\/p>\n<\/a><\/p>\n\r\n<#\r\n This script will Create, Import and Export Group Policy WMI Filters\r\n\r\n Syntax examples:\r\n Create:\r\n ManageWMIFilters.ps1 -Action Create -ReferenceFile DefaultWMIFilters.csv\r\n Export:\r\n ManageWMIFilters.ps1 -Action Export -ReferenceFile WMIFiltersExport.csv\r\n Import:\r\n ManageWMIFilters.ps1 -Action Import -ReferenceFile WMIFiltersExport.csv\r\n\r\n It was originally based on the following three scripts:\r\n 1) Using Powershell to Automatically Create WMI Filters:\r\n http:\/\/gallery.technet.microsoft.com\/scriptcenter\/f1491111-9f5d-4c83-b436-537eca9e8d94\r\n 2) Exporting and Importing WMI Filters with PowerShell: Part 1, Export:\r\n http:\/\/blogs.technet.com\/b\/manny\/archive\/2012\/02\/04\/perform-a-full-export-and-import-of-wmi-filters-with-powershell.aspx\r\n 3) Exporting and Importing WMI Filters with PowerShell: Part 2, Import:\r\n http:\/\/blogs.technet.com\/b\/manny\/archive\/2012\/02\/05\/exporting-and-importing-wmi-filters-with-powershell-part-2-import.aspx\r\n\r\n Another great reference:\r\n - Digging Into Group Policy WMI Filters and Managing them through PowerShell\r\n http:\/\/sdmsoftware.com\/group-policy-blog\/gpmc\/digging-into-group-policy-wmi-filters-and-managing-them-through-powershell\/\r\n\r\n I left the code as 3 separate modules so that it can be easily split and\r\n reused if preferred. Hence the reason why there is currently some duplicate\r\n code between the create and import sections.\r\n\r\n Modified all code to completely remove the requirement for the Active\r\n Directory PowerShell Module.\r\n\r\n Fixed an issue where it was not calculating the length of the supplied\r\n namespace. ie. The script would only import correctly if the namespace was\r\n root\\CIMv2. But when using the root\\virtualization namespace it would fail.\r\n This is actually an error found in all GPO WMI creation script I've found.\r\n They all assume that root\\CIMv2 is the only namespace used.\r\n\r\n If your Active Directory is based on Windows 2003 or has been upgraded\r\n from Windows 2003, you may may have an issue with System Owned Objects.\r\n Importing or adding a WMI Filter object into AD used to be a system only\r\n operation. So you previously needed to enable system only changes on a\r\n domain controller for a successful ldifde import.\r\n If this is the case you will need to set the following registry value:\r\n Key: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters\r\n Type: REG_DWORD\r\n Value: Allow System Only Change\r\n Data: 1\r\n\r\n Release 1.3\r\n Written by Jeremy@jhouseconsulting.com 11th September 2013\r\n Modified by Jeremy@jhouseconsulting.com 9th June 2014\r\n\r\n#>\r\n\r\n#-------------------------------------------------------------\r\nparam([String]$Action,[String]$ReferenceFile)\r\n\r\nWrite-Host -ForegroundColor Green "Verifying script parameters...`n"\r\n\r\n$helptext = $False\r\n\r\nif ([String]::IsNullOrEmpty($Action)) {\r\n write-host -ForeGroundColor Red "Action is a required parameter.`n"\r\n $helptext = $True\r\n} else {\r\n switch ($Action)\r\n {\r\n "Create" {$Create = $true;$Import = $false;$Export = $false}\r\n "Import" {$Create = $false;$Import = $true;$Export = $false}\r\n "Export" {$Create = $false;$Import = $false;$Export = $true}\r\n default {$Create = $false;$Import = $false;$Export = $false}\r\n }\r\n if ($Create -eq $false -AND $Import -eq $false -AND $Export -eq $false) {\r\n write-host -ForeGroundColor Red "The Action parameter is invalid.`n"\r\n $helptext = $True\r\n }\r\n}\r\n\r\nif ([String]::IsNullOrEmpty($ReferenceFile)) {\r\n write-host -ForeGroundColor Red "ReferenceFile is a required parameter. Exiting Script.`n"\r\n $helptext = $True\r\n}\r\n\r\nIf ($helptext) {\r\n $Message = "Syntax examples:"\r\n $Message = $Message + "`n`tCreate:"\r\n $Message = $Message + "`n`t`tManageWMIFilters.ps1 -Action Create -ReferenceFile DefaultWMIFilters.csv"\r\n $Message = $Message + "`n`tExport:"\r\n $Message = $Message + "`n`t`tManageWMIFilters.ps1 -Action Export -ReferenceFile WMIFiltersExport.csv"\r\n $Message = $Message + "`n`tImport:"\r\n $Message = $Message + "`n`t`tManageWMIFilters.ps1 -Action Import -ReferenceFile WMIFiltersExport.csv"\r\n write-host -ForeGroundColor Green $Message\r\n write-host -ForeGroundColor Red "`nExiting Script."\r\n Exit\r\n}\r\n\r\n#-------------------------------------------------------------\r\n\r\n# Set this to true to set the Allow System Only Change registry value\r\n$EnableAllowSystemOnlyChange = $False\r\n\r\n#-------------------------------------------------------------\r\nfunction Enable-ADSystemOnlyChange([switch] $disable)\r\n{\r\n # This function has been taken directly from the GPWmiFilter.psm1\r\n # module written by Bin Yi from Microsoft.\r\n $valueData = 1\r\n if ($disable)\r\n {\r\n $valueData = 0\r\n }\r\n $key = Get-Item HKLM:\\System\\CurrentControlSet\\Services\\NTDS\\Parameters -ErrorAction SilentlyContinue\r\n if (!$key) {\r\n New-Item HKLM:\\System\\CurrentControlSet\\Services\\NTDS\\Parameters -ItemType RegistryKey | Out-Null\r\n }\r\n $kval = Get-ItemProperty HKLM:\\System\\CurrentControlSet\\Services\\NTDS\\Parameters -Name "Allow System Only Change" -ErrorAction SilentlyContinue\r\n if (!$kval) {\r\n New-ItemProperty HKLM:\\System\\CurrentControlSet\\Services\\NTDS\\Parameters -Name "Allow System Only Change" -Value $valueData -PropertyType DWORD | Out-Null\r\n } else {\r\n Set-ItemProperty HKLM:\\System\\CurrentControlSet\\Services\\NTDS\\Parameters -Name "Allow System Only Change" -Value $valueData | Out-Null\r\n }\r\n}\r\n\r\n#-------------------------------------------------------------\r\nIf ($Import -eq $true) {\r\n\r\n if ((Test-Path $ReferenceFile) -eq $False) {\r\n Write-Host -ForegroundColor Red "The $ReferenceFile file is missing. Cannot import WMI Filters.`n"\r\n exit\r\n }\r\n\r\n $Header = "Name","Description","Filter"\r\n $WMIFilters = import-csv $ReferenceFile -Delimiter "`t" -Header $Header\r\n\r\n $RowCount = $WMIFilters | Measure-Object | Select-Object -expand count\r\n\r\n if ($RowCount -gt 0) {\r\n\r\n write-host -ForeGroundColor Green "Importing $RowCount WMI Filters`n"\r\n\r\n $Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\r\n $DomainName = $Domain.Name\r\n $DomainDistinguishedName = $Domain.GetDirectoryEntry() | Select-Object -ExpandProperty DistinguishedName\r\n\r\n $UseAdministrator = $False\r\n If ($UseAdministrator -eq $False) {\r\n $msWMIAuthor = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name\r\n } Else {\r\n $msWMIAuthor = "Administrator@" + $DomainName\r\n }\r\n\r\n foreach ($WMIFilter in $WMIFilters) {\r\n $WMIGUID = [string]"{"+([System.Guid]::NewGuid())+"}"\r\n $WMIDN = "CN="+$WMIGUID+",CN=SOM,CN=WMIPolicy,CN=System,"+$DomainDistinguishedName\r\n $WMICN = $WMIGUID\r\n $WMIdistinguishedname = $WMIDN\r\n $WMIID = $WMIGUID\r\n\r\n $now = (Get-Date).ToUniversalTime()\r\n $msWMICreationDate = ($now.Year).ToString("0000") + ($now.Month).ToString("00") + ($now.Day).ToString("00") + ($now.Hour).ToString("00") + ($now.Minute).ToString("00") + ($now.Second).ToString("00") + "." + ($now.Millisecond * 1000).ToString("000000") + "-000"\r\n $msWMIName = $WMIFilter.Name\r\n $msWMIParm1 = $WMIFilter.Description + " "\r\n $msWMIParm2 = $WMIFilter.Filter\r\n\r\n $array = @()\r\n $SearchRoot = [adsi]("LDAP:\/\/CN=SOM,CN=WMIPolicy,CN=System,"+$DomainDistinguishedName)\r\n $search = new-object System.DirectoryServices.DirectorySearcher($SearchRoot)\r\n $search.filter = "(objectclass=msWMI-Som)"\r\n $results = $search.FindAll()\r\n ForEach ($result in $results) {\r\n $array += $result.properties["mswmi-name"].item(0)\r\n }\r\n\r\n if ($array -notcontains $msWMIName) {\r\n write-host -ForeGroundColor Green "Importing the $msWMIName WMI Filter from $ReferenceFile`n"\r\n If ($EnableAllowSystemOnlyChange) {\r\n Enable-ADSystemOnlyChange\r\n }\r\n $SOMContainer = [adsi]("LDAP:\/\/CN=SOM,CN=WMIPolicy,CN=System,"+$DomainDistinguishedName)\r\n $NewWMIFilter = $SOMContainer.create('msWMI-Som',"CN="+$WMIGUID)\r\n $NewWMIFilter.put("msWMI-Name",$msWMIName)\r\n $NewWMIFilter.put("msWMI-Parm1",$msWMIParm1)\r\n $NewWMIFilter.put("msWMI-Parm2",$msWMIParm2)\r\n $NewWMIFilter.put("msWMI-Author",$msWMIAuthor)\r\n $NewWMIFilter.put("msWMI-ID",$WMIID)\r\n $NewWMIFilter.put("instanceType",4)\r\n $NewWMIFilter.put("showInAdvancedViewOnly","TRUE")\r\n $NewWMIFilter.put("distinguishedname",$WMIdistinguishedname)\r\n $NewWMIFilter.put("msWMI-ChangeDate",$msWMICreationDate)\r\n $NewWMIFilter.put("msWMI-CreationDate",$msWMICreationDate)\r\n $NewWMIFilter.setinfo()\r\n } Else {\r\n write-host -ForeGroundColor Yellow "The $msWMIName WMI Filter already exists`n"\r\n }\r\n }\r\n } else {\r\n Write-Host -ForegroundColor Red "The data in the $ReferenceFile file is missing.`n"\r\n }\r\n}\r\n\r\n#-------------------------------------------------------------\r\nIf ($Export -eq $true) {\r\n\r\n set-content $ReferenceFile $NULL\r\n\r\n $WMIFilters = @()\r\n\r\n $Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\r\n $DomainName = $Domain.Name\r\n $DomainDistinguishedName = $Domain.GetDirectoryEntry() | Select-Object -ExpandProperty DistinguishedName\r\n $SearchRoot = [adsi]("LDAP:\/\/CN=SOM,CN=WMIPolicy,CN=System,"+$DomainDistinguishedName)\r\n $search = new-object System.DirectoryServices.DirectorySearcher($SearchRoot)\r\n $search.filter = "(objectclass=msWMI-Som)"\r\n $results = $search.FindAll()\r\n ForEach ($result in $results) {\r\n $obj = New-Object -TypeName PSObject\r\n $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -value $result.properties["distinguishedname"].item(0)\r\n $obj | Add-Member -MemberType NoteProperty -Name "msWMI-Name" -value $result.properties["mswmi-name"].item(0)\r\n $obj | Add-Member -MemberType NoteProperty -Name "msWMI-Parm1" -value $result.properties["mswmi-parm1"].item(0)\r\n $obj | Add-Member -MemberType NoteProperty -Name "msWMI-Parm2" -value $result.properties["mswmi-parm2"].item(0)\r\n $obj | Add-Member -MemberType NoteProperty -Name "Name" -value $result.properties["name"].item(0)\r\n $WMIFilters += $obj\r\n }\r\n\r\n $RowCount = $WMIFilters | Measure-Object | Select-Object -expand count\r\n\r\n if ($RowCount -ne 0) {\r\n write-host -ForeGroundColor Green "Exporting $RowCount WMI Filters`n"\r\n\r\n foreach ($WMIFilter in $WMIFilters) {\r\n write-host -ForeGroundColor Green "Exporting the" $WMIFilter."msWMI-Name" "WMI Filter to $ReferenceFile`n"\r\n $NewContent = $WMIFilter."msWMI-Name" + "`t" + $WMIFilter."msWMI-Parm1" + "`t" + $WMIFilter."msWMI-Parm2"\r\n add-content $NewContent -path $ReferenceFile\r\n }\r\n write-host -ForeGroundColor Green "An export of the WMI Filters has been stored at $ReferenceFile`n"\r\n\r\n } else {\r\n write-host -ForeGroundColor Green "There are no WMI Filters to export`n"\r\n }\r\n}\r\n\r\n#-------------------------------------------------------------\r\nIf ($Create -eq $true) {\r\n\r\n if ((Test-Path $ReferenceFile) -eq $False) {\r\n Write-Host -ForegroundColor Red "The $ReferenceFile file is missing. Cannot create WMI Filters.`n"\r\n exit\r\n }\r\n\r\n $Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\r\n $DomainName = $Domain.Name\r\n $DomainDistinguishedName = $Domain.GetDirectoryEntry() | Select-Object -ExpandProperty DistinguishedName\r\n\r\n $UseAdministrator = $False\r\n If ($UseAdministrator -eq $False) {\r\n $msWMIAuthor = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name\r\n } Else {\r\n $msWMIAuthor = "Administrator@" + $DomainName\r\n }\r\n\r\n # Import WMI Filters From CSV\r\n # Name,Description,Filter\r\n $WMIFilters = import-csv $ReferenceFile\r\n\r\n $RowCount = $WMIFilters | Measure-Object | Select-Object -expand count\r\n\r\n if ($RowCount -gt 0) {\r\n\r\n write-host -ForeGroundColor Green "Creating $RowCount WMI Filters`n"\r\n\r\n foreach ($WMIFilter in $WMIFilters) {\r\n $WMIGUID = [string]"{"+([System.Guid]::NewGuid())+"}"\r\n $WMIDN = "CN="+$WMIGUID+",CN=SOM,CN=WMIPolicy,CN=System,"+$DomainDistinguishedName\r\n $WMICN = $WMIGUID\r\n $WMIdistinguishedname = $WMIDN\r\n $WMIID = $WMIGUID \r\n\r\n $now = (Get-Date).ToUniversalTime()\r\n $msWMICreationDate = ($now.Year).ToString("0000") + ($now.Month).ToString("00") + ($now.Day).ToString("00") + ($now.Hour).ToString("00") + ($now.Minute).ToString("00") + ($now.Second).ToString("00") + "." + ($now.Millisecond * 1000).ToString("000000") + "-000" \r\n\r\n $msWMIName = $WMIFilter.Name\r\n $msWMIParm1 = $WMIFilter.Description + " "\r\n $msWMIParm2 = "1;3;" + $WMIFilter.Namespace.Length.ToString() + ";" + $WMIFilter.Query.Length.ToString() + ";WQL;" + $WMIFilter.Namespace + ";" + $WMIFilter.Query + ";"\r\n\r\n $array = @()\r\n $SearchRoot = [adsi]("LDAP:\/\/CN=SOM,CN=WMIPolicy,CN=System,"+$DomainDistinguishedName)\r\n $search = new-object System.DirectoryServices.DirectorySearcher($SearchRoot)\r\n $search.filter = "(objectclass=msWMI-Som)"\r\n $results = $search.FindAll()\r\n ForEach ($result in $results) {\r\n $array += $result.properties["mswmi-name"].item(0)\r\n }\r\n\r\n if ($array -notcontains $msWMIName) {\r\n write-host -ForeGroundColor Green "Creating the $msWMIName WMI Filter from $ReferenceFile`n"\r\n If ($EnableAllowSystemOnlyChange) {\r\n Enable-ADSystemOnlyChange\r\n }\r\n $SOMContainer = [adsi]("LDAP:\/\/CN=SOM,CN=WMIPolicy,CN=System,"+$DomainDistinguishedName)\r\n $NewWMIFilter = $SOMContainer.create('msWMI-Som',"CN="+$WMIGUID)\r\n $NewWMIFilter.put("msWMI-Name",$msWMIName)\r\n $NewWMIFilter.put("msWMI-Parm1",$msWMIParm1)\r\n $NewWMIFilter.put("msWMI-Parm2",$msWMIParm2)\r\n $NewWMIFilter.put("msWMI-Author",$msWMIAuthor)\r\n $NewWMIFilter.put("msWMI-ID",$WMIID)\r\n $NewWMIFilter.put("instanceType",4)\r\n $NewWMIFilter.put("showInAdvancedViewOnly","TRUE")\r\n $NewWMIFilter.put("distinguishedname",$WMIdistinguishedname)\r\n $NewWMIFilter.put("msWMI-ChangeDate",$msWMICreationDate)\r\n $NewWMIFilter.put("msWMI-CreationDate",$msWMICreationDate)\r\n $NewWMIFilter.setinfo()\r\n } Else {\r\n write-host -ForeGroundColor Yellow "The $msWMIName WMI Filter already exists`n"\r\n }\r\n }\r\n } else {\r\n Write-Host -ForegroundColor Red "The data in the $ReferenceFile file is missing.`n"\r\n }\r\n}\r\n<\/pre>\n