Tag Archives: powershell

WMI filters in Group Policy gives me errors

When I started working with WMI filters to use in Group Policy, I was struck down by an error “Either the namespace entered is not a valid namespace on the local computer or you do not have access to this namespace on this computer”, the namespace being root\CIMv2.

After researching this issue on the Internet, I realised that I was not alone by any means, it seemed like a great deal of people had these problems. They felt their WMI queries were correct but Windows told them differently every time they saved the query. So, what to do about this?

First of all, make sure that you can list the root\CIMv2 namespace. You can do this by using Powershell with the following command:

PS1> (gwmi -namespace "root" -class "__Namespace" | Select Name)

You should see CIMv2 listed, otherwise you have bigger problems. Then you have to head into troubleshooting WMI and perhaps even repairing your WMI repository. You can read more about this at lansweeper.com. Microsoft also has a guide for WMI troubleshooting and also a specific tool called WMI Diagnosis Utility.

If you do see it, chances are that the error produced in GPMC (Group Policy Management Console) is actually just an irritating bug. I found two tools that can actually help you in building your queries, those being the Powershell “gwmi” command and the other being WMI Code Creator from Microsoft. The latter tool can produce code for querying WMI, but the reason I employ it is because it easily allows me to find all classes and parameters as well as query the properties on the machine I run it on. It can also query a remote machine. This allows me to check my WMI filters to see that they target the right type of computers or whatever the case may be.

The “gwmi” command is quite useful as it has a query flag which can be used like this:

PS1> gwmi -Query 'Select * from Win32_OperatingSystem where Version like "6.1%"'

This allows you to run your WMI query and check the output. The example above should produce output if you are running Windows 7. A very neat resource of WMI queries for different operating systems can be found on nogeekleftbehind.com.

WMI filters can be very powerful when employed in Group Policy. Instead of having to target every organisational unit that contains workstations running Windows 7, one WMI filter targeting all Windows 7 machines can be used instead. However, a word of caution as it is easy to make a mistake with your WMI filter and you can end up targeting other machines then the ones intended. This can produce some strange problems, so do test your WMI queries once or twice before deploying them.

I still get the same error as I started this post with when I try to save a WMI filter i GPMC, but it works never the less. The domain controller is fully patched, but it has not resolved the issue. For the time being, it seems that I have to live with this, but as long as it still works, I can deal with it.