WMI Filters

WMI filters decide whether a linked GPO applies to a specific machine based on a WMI query. We use WMI filter review to explain why a linked GPO did not apply, and we abuse WMI filter control to narrow or broaden the affected target set.

Enumerate WMI filters with LDAP

ldapsearch -LLL -x -H ldap://10.10.10.200 -D "ootw.local\\student" -w 'student' -b "CN=SOM,CN=WMIPolicy,CN=System,DC=ootw,DC=local" '(objectClass=msWMI-Som)' name msWMI-Name msWMI-Parm2 distinguishedName

Find GPOs that use WMI filters

ldapsearch -LLL -x -H ldap://10.10.10.200 -D "ootw.local\\student" -w 'student' -b "DC=ootw,DC=local" '(&(objectClass=groupPolicyContainer)(gPCWQLFilter=*))' displayName gPCWQLFilter gPCFileSysPath

PowerShell WMI filter inventory

Get-ADObject -SearchBase "CN=SOM,CN=WMIPolicy,CN=System,DC=ootw,DC=local" -LDAPFilter '(objectClass=msWMI-Som)' -Properties msWMI-Name,msWMI-Parm2 |
  Select-Object Name,msWMI-Name,msWMI-Parm2,DistinguishedName

GPOs with filter attached

Get-GPO -All | Select-Object DisplayName,Id,WmiFilter

Example filter logic

SELECT * FROM Win32_OperatingSystem WHERE ProductType = 1

Workstation-only and server-only meaning

ProductType = 1  Workstation
ProductType = 2  Domain Controller
ProductType = 3  Server

Abuse pattern

1. Find a dangerous GPO that is linked but filtered away from the desired target.
2. Identify the gPCWQLFilter value on the GPO.
3. Modify or replace the filter so the target now matches.
4. Force policy update or wait for normal policy processing.

Notes

WMI filter changes are scope changes. They may not create a new payload, but they can make an existing payload apply to a new set of machines.

Broken or slow WMI filters can delay policy processing and create noisy operational symptoms.