Comments for SDM Software | Group Policy Management & Administration Tools http://www.sdmsoftware.com The Group Policy Experts Mon, 30 Jan 2012 03:57:18 +0000 hourly 1 http://wordpress.org/?v=478 Comment on WMI Filter Test Utility Updated to Include timings by Darren Mar-Elia http://www.sdmsoftware.com/cool-new-products/wmi-filter-test-utility-updated-to-include-timiings/#comment-3888 Darren Mar-Elia Mon, 30 Jan 2012 03:57:18 +0000 http://sdmsoftware.com/blog/?p=253#comment-3888 Thanks Jeff! I will put it on the "list" for the next version. May be a while but good suggestions! -Darren Thanks Jeff! I will put it on the “list” for the next version. May be a while but good suggestions!
-Darren

]]> Comment on WMI Filter Test Utility Updated to Include timings by JRV http://www.sdmsoftware.com/cool-new-products/wmi-filter-test-utility-updated-to-include-timiings/#comment-3887 JRV Mon, 30 Jan 2012 03:24:29 +0000 http://sdmsoftware.com/blog/?p=253#comment-3887 Hi Darren, I've used WMI Filter Test for years and greatly appreciate it. I have a suggestion...in addition to allowing us to test WMI Filters already present in AD, let us enter WMI queries ad hoc to test them as we develop them, and before we deploy them. Once we have it right, THEN we can copy & paste into GPMC. Or (perhaps, if you have dev time to spare) WMIFT could create the WMI Filter automagically from the tested output. This would also be useful for much more than GPMC. Thinking, here, of VB or PowerShell scripts, and SCCM Queries. (The latter of which I happen to be using WMIFT for as I write this!) Hi Darren,

I’ve used WMI Filter Test for years and greatly appreciate it.

I have a suggestion…in addition to allowing us to test WMI Filters already present in AD, let us enter WMI queries ad hoc to test them as we develop them, and before we deploy them. Once we have it right, THEN we can copy & paste into GPMC. Or (perhaps, if you have dev time to spare) WMIFT could create the WMI Filter automagically from the tested output.

This would also be useful for much more than GPMC. Thinking, here, of VB or PowerShell scripts, and SCCM Queries. (The latter of which I happen to be using WMIFT for as I write this!)

]]> Comment on Digging Into Group Policy WMI Filters and Managing them through PowerShell by Martin http://www.sdmsoftware.com/gpmc/digging-into-group-policy-wmi-filters-and-managing-them-through-powershell/#comment-3740 Martin Tue, 24 Jan 2012 16:35:20 +0000 http://www.sdmsoftware.com/?p=871#comment-3740 This article was the result of me contacting GTSC for an explanation of this behaviour (: And for the user data: Sure you can filter for that, but you will always find a match if any previously logged in user matches the filter, it is not limited to the current user. I really struggled with that when trying to find a method of filtering to enable folder redirection only if the current user has a homeset - and I gave up... This article was the result of me contacting GTSC for an explanation of this behaviour (:

And for the user data: Sure you can filter for that, but you will always find a match if any previously logged in user matches the filter, it is not limited to the current user. I really struggled with that when trying to find a method of filtering to enable folder redirection only if the current user has a homeset – and I gave up…

]]> Comment on Digging Into Group Policy WMI Filters and Managing them through PowerShell by Darren Mar-Elia http://www.sdmsoftware.com/gpmc/digging-into-group-policy-wmi-filters-and-managing-them-through-powershell/#comment-3738 Darren Mar-Elia Tue, 24 Jan 2012 14:17:11 +0000 http://www.sdmsoftware.com/?p=871#comment-3738 Great information Martin. I did not know about the timeout but indeed I found this article (http://support.microsoft.com/kb/2587435). Thanks! As for your second comment, interesting point and I do see that for Win32_Environment. Is it true for all classes that hold per-user data? In any case, I don't know that it completely invalidates using per-user data in a WMI filter but it is important to understand that, for sure. Thanks again for pointing that out! Great information Martin. I did not know about the timeout but indeed I found this article (http://support.microsoft.com/kb/2587435). Thanks! As for your second comment, interesting point and I do see that for Win32_Environment. Is it true for all classes that hold per-user data? In any case, I don’t know that it completely invalidates using per-user data in a WMI filter but it is important to understand that, for sure. Thanks again for pointing that out!

]]> Comment on Leveraging Group Policy Preferences Item-Level Targeting from “Downlevel” Group Policy by Darren Mar-Elia http://www.sdmsoftware.com/uncategorized/leveraging-group-policy-preferences-item-level-targeting-from-downlevel-group-policy/#comment-3737 Darren Mar-Elia Tue, 24 Jan 2012 13:57:39 +0000 http://www.sdmsoftware.com/?p=845#comment-3737 Yep, thanks Martin. I'm aware of CSE order for sure. I left it out of this discussion but you're absolutely right. The main point here is that the environment variable has to be there before the filter will work! Yep, thanks Martin. I’m aware of CSE order for sure. I left it out of this discussion but you’re absolutely right. The main point here is that the environment variable has to be there before the filter will work!

]]> Comment on Digging Into Group Policy WMI Filters and Managing them through PowerShell by Martin http://www.sdmsoftware.com/gpmc/digging-into-group-policy-wmi-filters-and-managing-them-through-powershell/#comment-3736 Martin Tue, 24 Jan 2012 11:34:30 +0000 http://www.sdmsoftware.com/?p=871#comment-3736 Excellent article! One thing I want to point out: The performance issue with WMI filters was dangerous in past days - queries for win32_product easily could take several minutes. With Win7 (and Vista SP2) Microsoft introduced a hard coded limit for filter evaluation (30 seconds). Any filter with longer duration will be interrupted and evaluate to false. And WMI filters are not really suitable to filter for user properties - WMI always sees "everything" on the computer, e.g. if filtering for win32_environment, it sees all variables from all users ever logging on to the computer. sincerely, Martin Excellent article! One thing I want to point out: The performance issue with WMI filters was dangerous in past days – queries for win32_product easily could take several minutes.
With Win7 (and Vista SP2) Microsoft introduced a hard coded limit for filter evaluation (30 seconds). Any filter with longer duration will be interrupted and evaluate to false.

And WMI filters are not really suitable to filter for user properties – WMI always sees “everything” on the computer, e.g. if filtering for win32_environment, it sees all variables from all users ever logging on to the computer.

sincerely, Martin

]]> Comment on Leveraging Group Policy Preferences Item-Level Targeting from “Downlevel” Group Policy by Martin http://www.sdmsoftware.com/uncategorized/leveraging-group-policy-preferences-item-level-targeting-from-downlevel-group-policy/#comment-3735 Martin Tue, 24 Jan 2012 11:28:36 +0000 http://www.sdmsoftware.com/?p=845#comment-3735 Hi, Darren. "I linked the GPO with the ILT filter higher in precedence than the restricted groups GPO on the OU and it appeared that the ILT filter and environment variable processed first and then the restricted group policy was applied within the same cycle, so that was good!" The main point here is NOT the precedence, but the CSE processing order. Mark has a complete table of CSEs in their order on his web site: http://www.gruppenrichtlinien.de/Grundlagen/Client_Side_Extensions.htm That has to be combined with the group policy evaluation process as found in http://technet.microsoft.com/en-us/library/cc784268%28WS.10%29.aspx ("GPO List creation"). Anyway - ILT is cool :-) Especially the "store in variable" feature. sincerely, Martin Hi, Darren.
“I linked the GPO with the ILT filter higher in precedence than the restricted groups GPO on the OU and it appeared that the ILT filter and environment variable processed first and then the restricted group policy was applied within the same cycle, so that was good!”

The main point here is NOT the precedence, but the CSE processing order. Mark has a complete table of CSEs in their order on his web site: http://www.gruppenrichtlinien.de/Grundlagen/Client_Side_Extensions.htm
That has to be combined with the group policy evaluation process as found in http://technet.microsoft.com/en-us/library/cc784268%28WS.10%29.aspx (“GPO List creation”).

Anyway – ILT is cool :-) Especially the “store in variable” feature.

sincerely, Martin

]]> Comment on More on the Group Policy Health Cmdlet by Darren Mar-Elia http://www.sdmsoftware.com/powershell/more-on-the-group-policy-health-cmdlet/#comment-1493 Darren Mar-Elia Sun, 27 Nov 2011 18:22:02 +0000 http://sdmsoftware.com/blog/2009/01/09/more-on-the-group-policy-health-cmdlet/#comment-1493 That's correct Ed. You can iterate into the ComputerCSEsProcessed or UserCSEsProcessed properties like this: <code>$health = Get-SDMGPHealth -ComputerName win7-x86-1 foreach ($cse in $health.ComputerCSEsProcessed) {$cse.GPObyCSE}</code> Darren That’s correct Ed. You can iterate into the ComputerCSEsProcessed or UserCSEsProcessed properties like this:
$health = Get-SDMGPHealth -ComputerName win7-x86-1
foreach ($cse in $health.ComputerCSEsProcessed) {$cse.GPObyCSE}

Darren

]]> Comment on More on the Group Policy Health Cmdlet by Ed http://www.sdmsoftware.com/powershell/more-on-the-group-policy-health-cmdlet/#comment-1446 Ed Thu, 24 Nov 2011 18:38:35 +0000 http://sdmsoftware.com/blog/2009/01/09/more-on-the-group-policy-health-cmdlet/#comment-1446 Thanks for the reply. So in the example since the user and computer core status show a "The operation completed successfully" status, I would guess that there was a failure detected with either the user or computer CSE processing. Would that be a correct assumption? If so, what would you suggest the command line look like to locate the failure? Thanks, Ed Thanks for the reply. So in the example since the user and computer core status show a “The operation completed successfully” status, I would guess that there was a failure detected with either the user or computer CSE processing. Would that be a correct assumption? If so, what would you suggest the command line look like to locate the failure?

Thanks,
Ed

]]> Comment on More on the Group Policy Health Cmdlet by Darren Mar-Elia http://www.sdmsoftware.com/powershell/more-on-the-group-policy-health-cmdlet/#comment-1442 Darren Mar-Elia Thu, 24 Nov 2011 06:40:19 +0000 http://sdmsoftware.com/blog/2009/01/09/more-on-the-group-policy-health-cmdlet/#comment-1442 Ed- A red status gets registered when a failure is detected in either core processing (the part of the GP Processing cycle where the computer or user evaluates what GPOs need to be processed) or in CSE processing (where each policy area runs in turn to apply the settings). Darren Ed-
A red status gets registered when a failure is detected in either core processing (the part of the GP Processing cycle where the computer or user evaluates what GPOs need to be processed) or in CSE processing (where each policy area runs in turn to apply the settings).

Darren

]]>