Home / server / Questions / 775340
Accepted
Jeff Miles
Asked: 2016-05-07 13:11:28 +0800 CST

WMI query to find lack of drive letter for Group Policy

  • 772

I'm building a group policy to apply to a subset of users within my organization. This subset of users have no Home Directory set on their Active Directory object, whereas other users have an I:\ drive assigned.

I need to find a WMI query which will allow the User Configuration GPO to apply to a user with no I:\ drive.

I can easily find the inverse of that:

Select * From Win32_LogicalDisk Where DeviceID = 'I:'

But if I make this WHERE DeviceID <> 'I:\', it returns C:, D: and other mapped drives.

I thought about querying the user profile with something like this:

select RoamingPath from Win32_UserProfile where RoamingPath <> '\\*'

however that returns many results for system accounts and local administrator profiles, rather than the logged on user.

I've read that it is possible to query AD directly, but the command below gives me an "Invalid Class" error and I don't know if it would apply to the logged in user:

select * from ds_user where ADSIPath = LDAP://OU=CA,DC=global,DC=opus AND DS_homeDirectory=’*’

I think ideally this would be solved by using Win32_LogicalDisk to count the total number of drives, a second query to get a count of I:\ drives (either 1 or 0), and then subtract the second result from the first. If the result is = the first query, I have my set of users. So far no luck on finding syntax to do this within a GPO wmi filter though.

group-policy wmi

1 Answers

  1. Best Answer

    I have determined that do accomplish this exactly as I've defined in my question is not really possible.

    The two best options I have come across are:

    1. Inverted WMI Filters - Create an environment variable per user/PC which produces a result based on required logic. Then use a regular WMI query to filter on that environment variable.
    2. Scheduled PowerShell query - as Yanick suggested in the comments, create a PowerShell query which filters users based on required logic (i.e. homeDrive attribute being empty) and then add these user accounts into a group, which can then be used for Security Filtering on the GPO. This PowerShell is then scheduled on a LAN server to run repeatedly.

    I've chosen option #2 in my environment.

    • 0