Some useful WMI Filters


Written by

WMI Filters are filters used via Group Policy Managment in Active Directory to control what GPO’s are applied to what machine. They are rather simple to understand as they are structured like SQL all you need to know is the data stored in WMI.

Here’s a couple of filters I have found useful.

Detect OS Version:

Windows 7

SELECT * FROM Win32_OperatingSystem WHERE Version like "6.1%" AND ProductType = "1"

Widows 2008 R2

SELECT * FROM Win32_OperatingSystem WHERE Version like "6.1%" AND ProductType = "2"

Windows Vista

SELECT * FROM Win32_OperatingSystem WHERE Version like "6.0%" AND ProductType = "1"

Windows 2008

SELECT * FROM Win32_OperatingSystem WHERE Version like "6.0%" AND ProductType = "2"

Windows XP

SELECT * FROM Win32_OperatingSystem WHERE Version like "5.1%"

Windows 2003

SELECT * FROM Win32_OperatingSystem WHERE Version like "5.2%"

Windows 2000

SELECT * FROM Win32_OperatingSystem WHERE Version like "5.0%"

Detect Arcitecture:

Windows x64 (64bit)

SELECT * FROM Win32_Processor WHERE AddressWidth="64"

Windows x86 (32bit)

SELECT * FROM Win32_Processor WHERE AddressWidth="32"

Detect Service Pack:

Service Pack 3 or above

SELECT * FROM Win32_OperatingSystem WHERE ServicePackMajorVersion>=3

Pre-Service Pack 3

SELECT * FROM Win32_OperatingSystem WHERE ServicePackMajorVersion<3

The filters can be included together to create more precise detection such as Windows XP SP2 or Windows 7 x64 SP1.

Hope these help others as much as myself.