WMI filter for subnet filtered Group Policy

This post describes a WMI filter used to provide Group Policy based on the client subnet. This can be useful when site-based policy is not appropriate, or for more granular control of specific subnets within sites.

The WMI filter used:

Select * FROM Win32_IP4RouteTable
WHERE ((Mask='255.255.255.255' AND NextHop='127.0.0.1')
AND (Destination Like '10.0.0.%' OR Destination Like '10.0.1.%' OR Destination Like '10.0.2.%'))

Originally this was used to define a DNS suffix search list for computers on a particular subnet. Other potential uses include branding and hardening of clients on specific subnets, such as privileged network or remote access subnets.

Why the Win32_IP4RouteTable class was used in the WMI query:

• Using the routing table to determine the local IP is not very intuitive, it would make more sense to use something like win32_networkadapterconfiguration, but the relevant information is stored in arrays, which cannot currently be processed by WMI filters. (or WMI queries in WHERE clauses)
• The route table is filtered to ensure only the local address is processed by including only the local broadcast address and the localhost hop, and then checking the subnet. Note that a /24 is the only subnet size that will be accurate when validating only on the last octet (the query above).

GPMC limitations:

1. GPMC Modelling doesn't seem accurate, ie. some XPSP2 workstations processing this policy return True for the WMI filter, even though 'gpresult /z' on the workstation accurately reports that the WMI filter caused the policy to not apply.

Using UserEnv Debugging to verify:

1. reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v UserEnvDebugLevel /d 0x00010002 /t reg_dword
   
2. gpupdate /force /target:computer

c:\windows\debug\netlogon.log should then show something like:

   USERENV(1c8.650) 00:30:03:191 FilterCheck: Found WMI Filter id of: <[domain.com;{B3942687-E8A9-4602-9365- E4C617980939};0]> 
   USERENV(1c8.650) 00:30:03:253 ProcessGPO: GPO passes the filter check. 

Other options considered to provide a similar result:

1. A security group filtered GPO, which would require manually adding and removing computers (or potentially automated with an export from DHCP that automatically added computers from the subnets to the security group)
   
2. DHCP Scope option for configuring the DNS suffix search list (119 I think) - not currently supported by XP
   
3. Some form of DHCP Scope ID that is recognised in XP and can be read through WMI or the registry
   
4. DHCP Option 61 - Unique scope ID read from the registry (http://support.microsoft.com/kb/172408)
   
5. AD Site - Separate sites containing the subnets, with a site-based group policy (although SDOU suggests this wouldn't work, as the OU policy would overwrite the site based policy - the closer to the object the higher priority)
   
6. Something in an automated process running on each workstation that would determine network changes and make local changes.
   

Wayne's World of IT (WWoIT), Copyright 2008 Wayne Martin.