Quick Fix: Stop Surface Devices Applying GPO

A question in the SBS Forum led me to this post, a quick way to prevent a Surface Pro 3 from applying a given GPO.

The way i suggested the poster do this was with a WMI Filter.

So, how to do this?

Well given the nature of a WMI filter is to look for a value, that in our case we need to be true, we should probably start by finding a Surface and looking for such a value.

I chose to look for the model of the machine.

Using Win32_ComputerSystem we can query for just such a value.

In PowerShell we can enter..

Get-WMIObject Win32_ComputerSystem –Computer Surface-01

We can see here the Model clearly shows us it is a Surface Pro 3. Excellent news.

Excellent news.

Now we can construct a WMI query for a Surface Pro 3 device.

That query would look like this:

SELECT * FROM Win32_ComputerSystem WHERE Model =”Surface Pro 3″

The above query will be TRUE if the device is a Surface Pro 3, this means any GPO using that WMI filter will be applied, but only to an SP3.

If we want to have the GPO apply to anything, excluding an SP3 we simply do the following..

SELECT * FROM Win32_ComputerSystem WHERE Model !=”Surface Pro 3″

We can also use WILDCARDs if we want to, to include other models of Surface in the exclusion..

SELECT * FROM Win32_ComputerSystem WHERE NOT Model LIKE “%Surface%”

Remember, using WBEMTest is a great way to work out your WMI query before testing on actual GPOs.

Related: How to make a WMI Filter?