How can I restrict the application of Group Policy Object (GPOs) depending on the client machine's OS?

A. Windows Server 2003 introduced the ability to use a Windows Management Instrumentation (WMI) filter to control application of a linked GPO. WMI filters are applied only to Windows 2003 and Windows XP machines; other OSs ignore the filter and apply the GPO (you also need Windows 2003 domain controllers--DCs). Eventually, all machines will understand WMI filters, but until then, if you need different settings between, for example, Windows 2000 Server machines and XP machines, you need to create two GPOs, one that has the settings for Win2K Server machines and one containing settings for the XP machines. Make the Win2K Server GPO higher in priority and set the WMI policy for the Win2K Server GPO so that XP machines don't run it. This configuration means that the Win2K Server clients would run both policies, but the Win2K Server policy has a higher priority and will take precedence. The XP client won't run the Win2K Server policy because of the WMI filter. Instead it will run only the XP policy.

To create a WMI filter, perform these steps:

You can determine whether the filter works by running the gpupdate command (to refresh the policy), then running the gpresult command. For example, on a non-XP machine, the gpresult command returns this output:

The following GPOs were not applied because they were filtered out.

-------------------------------------------------------------------XPOnlyFiltering: Denied (WMI Filter)WMI Filter: XPOnlyOn an XP machine I see the policy was applied:Applied Group Policy Objects-----------------------------Default Domain PolicyXPOnly

For more help with WMI, download the WMI administrative tools at http://www.microsoft.com/downloads/release.asp?releaseid=40804 .