Posted on

OS Version Queries for WMI Filters

NOTE: Updated Feb 13, 2020 to include Windows Server 2019

More likely than not, if you’re using Group Policy to push out software installation or registry entries to client machines or servers on the domain, the particular policy settings may be different depending on the OS version or architecture.

Examples, Group Policy Objects may need to be filtered by:

  • Desktop OS / Server OS
  • Domain Controller / Non-Domain Controller
  • 32-bit / 64-bit

If you haven’t used Windows Management Instrumentation (WMI) filters before, they show up in Group Policy Management at the bottom, between Group Policy Objects and Starter GPOs.

Common OS WMI Filters

The WMI filters use a query to scope down the Group Policy Object applicability. Here’s what a typical WMI OS filter looks like:

WMI filter

select * from Win32_OperatingSystem WHERE Version like

WMI Win32_OperatingSystem ProductType Tips:

  • ProductType 1 = Desktop OS
  • ProductType 2 = Server OS – Domain Controller
  • ProductType 3 = Server OS – Not a Domain Controller

WMI Win32_OperatingSystem Version Number Tips:

  • 5.1 – Windows XP
  • 5.2 – Windows Server 2003
  • 5.2.3 – Windows Server 2003 R2
  • 6.0 – Windows Vista & Windows Server 2008
  • 6.1 – Windows 7 & Windows Server 2008 R2
  • 6.2 – Windows 8 & Windows Server 2012
  • 6.3 – Windows 8.1 & Windows Server 2012 R2
  • 10.0 – Windows 10 & Windows Server 2016 & 2019

To create your own WMI filters, here is an updated list of WMI filter queries from Window XP – Windows 10 and from Server 2003 to Server 2019.

IMPORTANT DISCLAIMER:
Always test your Group Policies and WMI filters before deploying.

DESKTOP WMI QUERIES

ANY WINDOWS DESKTOP OS

  • Any Windows Desktop OS – Version 1
    SELECT * FROM Win32_OperatingSystem WHERE ProductType = “1”
  • Any Windows Desktop OS – Version 2 (better for Win7 sometimes)
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType <> “2”) AND (ProductType <> “3”)
  • Any Windows Desktop OS – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE ProductType = “1” AND NOT OSArchitecture = “64-bit”
  • Any Windows Desktop OS – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE ProductType = “1” AND OSArchitecture = “64-bit”

WINDOWS XP

  • Windows XP
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “5.1%” or Version like “5.2%”) AND ProductType=”1″
  • Windows XP – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “5.1%” or Version like “5.2%”) AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows XP – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “5.1%” or Version like “5.2%”) AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS VISTA

  • Windows Vista
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”1″
  • Windows Vista – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows Vista – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS 7

  • Windows 7
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.1%” AND ProductType=”1″
  • Windows 7 – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.1%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows 7 – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.1%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS 8

  • Windows 8
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.2%” AND ProductType=”1″
  • Windows 8 – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.2%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows 8 – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.2%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS 8.1

  • Windows 8.1
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.3%” AND ProductType=”1″
  • Windows 8.1 – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.3%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows 8.1 – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.3%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

WINDOWS 10

  • Windows 10
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “10.0%” AND ProductType=”1″
  • Windows 10 – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “10.0%” AND ProductType=”1″ AND NOT OSArchitecture = “64-bit”
  • Windows 10 – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “10.0%” AND ProductType=”1″ AND OSArchitecture = “64-bit”

SERVER WMI QUERIES

ANY WINDOWS SERVER OS

  • Any Windows Server OS
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “2”) OR (ProductType = “3”)
  • Any Windows Server OS – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “2”) OR (ProductType = “3”) AND NOT OSArchitecture = “64-bit”
  • Any Windows Server OS – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “2”) OR (ProductType = “3”) AND OSArchitecture = “64-bit”
  • Any Windows Server – Domain Controller
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “2”)
  • Any Windows Server – Domain Controller – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “2”) AND NOT OSArchitecture = “64-bit”
  • Any Windows Server – Domain Controller – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “2”) AND OSArchitecture = “64-bit”
  • Any Windows Server – Non-Domain Controller
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “3”)
  • Any Windows Server – Non- Domain Controller – 32-bit
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “3”) AND NOT OSArchitecture = “64-bit”
  • Any Windows Server – Non-Domain Controller – 64-bit
    SELECT * FROM Win32_OperatingSystem WHERE (ProductType = “3”) AND OSArchitecture = “64-bit”

WINDOWS SERVER 2003

  • Windows Server 2003     
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2%” AND ProductType<>”1″
  • Windows Server 2003 – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2%” AND ProductType=”2″
  • Windows Server 2003 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2%” AND ProductType=”3″
  • Windows Server 2003 – 32-bit – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2%” AND ProductType=”2″ AND NOT OSArchitecture = “64-bit”
  • Windows Server 2003 – 32-bit – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2%” AND ProductType=”3″ AND NOT OSArchitecture = “64-bit”
  • Windows Server 2003 – 64-bit – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2%” AND ProductType=”2″ AND OSArchitecture = “64-bit”
  • Windows Server 2003 – 64-bit – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2%” AND ProductType=”3″ AND OSArchitecture = “64-bit”

WINDOWS SERVER 2003 R2

  • Windows Server 2003 R2     
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2.3%” AND ProductType<>”1″
  • Windows Server 2003 R2 – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2.3%” AND ProductType=”2″
  • Windows Server 2003 R2 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2.3%” AND ProductType=”3″
  • Windows Server 2003 R2 – 32-bit – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2.3%” AND ProductType=”2″ AND NOT OSArchitecture = “64-bit”
  • Windows Server 2003 R2 – 32-bit – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2.3%” AND ProductType=”3″ AND NOT OSArchitecture = “64-bit”
  • Windows Server 2003 R2 – 64-bit – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2.3%” AND ProductType=”2″ AND OSArchitecture = “64-bit”
  • Windows Server 2003 R2 – 64-bit – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.2.3%” AND ProductType=”3″ AND OSArchitecture = “64-bit”

WINDOWS SERVER 2008

  • Windows Server 2008     
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType<>”1″
  • Windows Server 2008 – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”2″
  • Windows Server 2008 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”3″
  • Windows Server 2008 – 32-bit – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”2″ AND NOT OSArchitecture = “64-bit”
  • Windows Server 2008 – 32-bit – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”3″ AND NOT OSArchitecture = “64-bit”
  • Windows Server 2008 – 64-bit – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”2″ AND OSArchitecture = “64-bit”
  • Windows Server 2008 – 64-bit – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.0%” AND ProductType=”3″ AND OSArchitecture = “64-bit”

WINDOWS SERVER 2008 R2

  • Windows Server 2008 R2     
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.1%” AND ProductType<>”1″
  • Windows Server 2008 R2 – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.1%” AND ProductType=”2″
  • Windows Server 2008 R2 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.1%” AND ProductType=”3″

WINDOWS SERVER 2012

  • Windows Server 2012     
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.2%” AND ProductType<>”1″
  • Windows Server 2012 – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.2%” AND ProductType=”2″
  • Windows Server 2012 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.2%” AND ProductType=”3″

WINDOWS SERVER 2012 R2

  • Windows Server 2012R2     
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.3%” AND ProductType<>”1″
  • Windows Server 2012 R2 – DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.3%” AND ProductType=”2″
  • Windows Server 2012 R2 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “6.3%” AND ProductType=”3″

WINDOWS SERVER 2016 *

  • Windows Server 2016     
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “10.0.14393%”) OR (Version LIKE “10.0.16299%”) OR (Version LIKE “10.0.17134%”) AND ProductType<>”1″
  • Windows Server 2016 – DC
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “10.0.14393%”) OR (Version LIKE “10.0.16299%”) OR (Version LIKE “10.0.17134%”) AND ProductType=”2″
  • Windows Server 2016 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “10.0.14393%”) OR (Version LIKE “10.0.16299%”) OR (Version LIKE “10.0.17134%”) AND ProductType=”3″

WINDOWS SERVER 2019 *

  • Windows Server 2019     
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “10.0.17763%”) OR (Version LIKE “10.0.18362%”) OR (Version LIKE “10.0.18363%”) AND ProductType<>”1″
  • Windows Server 2019 – DC
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “10.0.17763%”) OR (Version LIKE “10.0.18362%”) OR (Version LIKE “10.0.18363%”) AND ProductType=”2″
  • Windows Server 2019 – non-DC
    SELECT * FROM Win32_OperatingSystem WHERE (Version LIKE “10.0.17763%”) OR (Version LIKE “10.0.18362%”) OR (Version LIKE “10.0.18363%”) AND ProductType=”3″

* A few notes about the “OR” operator:

First – The reason for the “OR” statements in Server 2016 and Server 2019 WMI Query Filters is because there are multiple builds, as shown in the table below. These multiple builds are part of Microsoft’s Windows as a service (Waas) plan.

Second – “Or” combines two conditions. When more than one logical operator is used in a statement, the OR operators are evaluated after the AND operators. (Source)

Major Minor Version Build Info Released
10 0 1607 14393 2016 RTM LTSC 09/26/2016
10 0 1709 16299 2016 SAC 10/17/2017
10 0 1803 17134 2016 SAC 04/30/2018
10 0 1809 17763 2019 LTSC 11/13/2018
10 0 1903 18362 2019 SAC 5/21/2019
10 0 1909 18363 2019 SAC 11/12/2019

Helpful OS Term Abbreviations
    VN:F [1.9.20_1166]
    Rating: 9.9/10 (45 votes cast)
    Posted on

    Download – Windows Security Audit Events Spreadsheet

    Title: Windows Security Audit Events Spreadsheet
    Published: 12/02/2015
    Publisher: Microsoft Corporation
    Version: November 2015
    File name: WindowsSecurityAuditEvents.xlsx
    Size: 70 KB
    Download URL: Click here for download

    Pop Quiz:

    1) What’s the Event ID for an Account Lockout?

    2) What about the Event ID denoting that permissions were changed on an object?

    3) Or the Event ID for locking or unlocking a workstation?

    Don’t worry, I can’t remember those off the top of my head either. And that usually means sifting through bookmarked links, PDFs or hitting Google to look it up.

    Fortunately, Microsoft has an Excel spreadsheet detailing 412 different Event IDs related to Windows Security Audit Events. Those 400+ Event IDs are broken up into the following nine categories:

    • Account Logon
    • Account Management
    • Detailed Tracking
    • DS Access
    • Logon/Logoff
    • Object Access
    • Policy Change
    • Privilege Use
    • System

    Another example but in this case physical casino security personnel will be on top of the barricades and they will be patrolling the building, like hvad er et pund i danske kroner.

    In an unprecedented move, officials in the city of Valencia launched a national protest. The protest, attended by more than 30,000 people, was organized on social media across the country in support of the new law.

    The protesters included representatives from local government districts, the local media, social media and religious institutions including faith clubs.

    The spreadsheet also contains a tab with a complete description of the event message. This is a great tool for creating event monitors. Download and enjoy!

    VN:F [1.9.20_1166]
    Rating: 10.0/10 (2 votes cast)
    Posted on

    Windows Server 2012 and R2 Locks and Limits Hosting

    The question came up today about using Windows Server Essentials as a RADIUS server. Part of the consideration involves the arbitrary restrictions placed on the OS. Microsoft differentiates the server products with what are affectionately know as “Locks and Limits”.

    Most folks in IT are aware of OS  hosting limits like the number of users in Windows Server or not being able to RDP into Windows 7 Home Edition. But there are other less-obvious limits like RAM or IAS, RRAS & SMB connection limits is probably the most important thing because of the new limitations on the platforms and OS. Hosting is an integral part of what users are doing on the os due to the increase in web services connecting to them.

    Fortunately there are two handy spreadsheets that detail the Limits, Roles & Features that are (or are not) available in Windows Server 2012 & R2 Editions.

    Windows Server 2012 R2 Locks and Limits

    Windows Server 2012 R2 Locks & Limits
    File: Windows Server 2012 R2 Products and Editions Comparison.pdf (222 KB)
    URL: http://www.microsoft.com/en-us/download/details.aspx?id=41703

    • Windows Server 2012 R2 Datacenter
    • Windows Server 2012 R2 Standard
    • Windows Server 2012 R2 Essentials
    • Windows Server 2012 R2 Foundation
    • Microsoft Hyper-V Server 2012 R2
    • Windows Storage Server 2012 R2 Standard
    • Windows Storage Server 2012 R2 Workgroup

    Windows Server 2012 Locks & Limits
    File: Windows Server 2012 Products and Editions Comparison.pdf (226 KB)
    URL: http://www.microsoft.com/en-us/download/details.aspx?id=38809

    • Windows Server 2012 Datacenter
    • Windows Server 2012 Standard
    • Windows Server 2012 Essentials
    • Windows Server 2012 Foundation
    • Microsoft Hyper-V Server 2012
    • Windows Storage Server 2012 Standard
    • Windows Storage Server 2012 Workgroup
    • Windows MultiPoint Server 2012 Premium
    • Windows MultiPoint Server 2012 Standard

    Currently, there is no word yet on Windows Server 2016 since it’s still in Technical Preview at this time. However, once the licensing folks figure out how to squeeze every penny out of Server 2016 (I’m very interested to see what they do with Nano Edition) there should be an updated spreadsheet released.

    VN:F [1.9.20_1166]
    Rating: 10.0/10 (1 vote cast)
    Posted on

    Download – Group Policy Settings for Server 2016 TP4

    Title: Group Policy Settings Reference for Windows and Windows Server
    Version: July 2015 (Updated for Server 2016 TP4)
    Published: 11/23/2015
    Download: http://www.microsoft.com/en-us/download/details.aspx?id=25250
    File names:

    • TP4 Policy Settings Spreadsheet.xlsx (654 KB)
    • Windows 10 ADMX spreadsheet.xlsx (654 KB)
    • Windows 8.1 Update and Windows Server 2012 R2 Update 1.xlsx (788 KB)
    • WindowsServer2003SP2GroupPolicySettings.xls (3.9 MB)
    • WindowsServer2008andWindowsVistaSP1GroupPolicySettings.xlsx (512 KB)
    • WindowsServer2008R2andWindows7GroupPolicySettings.xlsx (612 KB)
    • WindowsServer2012andWindows8GroupPolicySettings.xlsx (690 KB)
    • WindowsServer2012R2andWindows8.1GroupPolicySettings.xlsx (628 KB)
    • WindowsServer2012R2UpdateGroupPolicySettings.xlsx (634 KB)
    • WindowsVistaGroupPolicySettings.xls (1.9 MB)

    Description

    These spreadsheets list the policy settings for computer and user configurations that are included in the Administrative template files delivered with the Windows operating systems specified. You can configure these policy settings when you edit Group Policy Objects.

     

    VN:F [1.9.20_1166]
    Rating: 10.0/10 (1 vote cast)
    Posted on

    Cannot Login to Skype on Windows Server 2016 TP3

    While kicking the tires on a Windows Server 2016 TP3 virtual machine in Microsoft Azure, I decided to try and install Skype. (Not recommended – I know).

    The Skype 7.14 application installed just fine, but when I tried to login to Skype with my Windows Live ID I received the following error message:

    “Your browser is currently set to block cookies. Your browser must allow cookies before you can use a Microsoft account.”

    At first I thought the error message was related to Microsoft Edge, since you’re not allowed to run Edge with the default (500) Administrator account. Logging in with a different account didn’t resolve the error either.

    Enabled Cookies in IE 11, still no joy.

    THE FIX

    I added http://skype.com and https://skype.com to trusted sites in IE 11, then I could login to Skype.

    Internet Explorer | Internet Options | Security | Trusted Sites | Sites

    It’s a pretty simple fix in hindsight, but one that isn’t blatantly obvious at first.

    VN:F [1.9.20_1166]
    Rating: 10.0/10 (1 vote cast)