GPO WMI Filter – How to Import .mof File

active-directorygroup-policywmi

I've got a couple of exported GPO WMI filters off an AD domain as .MOF files. I see that I can import them using the Group Policy Management console but would rather like to re-import them via a script to automate the entire process.

I have not been able to find any decent documentation on how this works and the scripts available on TechNet1 are mostly going by reading property values from the source directory and writing them to the destination.

I would like to retain the ability to use GPMC to restore WMI filter backups manually, if needed. So an approach to simply use the .mof files created by GPMC upon WMI filter export is required.

1 Interestingly, different Microsoft employees have apparently worked on similar problems over the years, all coming to similar solutions published on TechNet:

Best Answer

A .mof is an input file to the mofcomp utility which is present on every Windows system. You just need to provide the file name and the corresponding namespace as parameters to make it work.

The file name is obviously the easy part - this is something you specify when exporting the WMI filter. But mofcomp would not run the .mof export without the correct namespace as it does not know where to find the MSFT_SomFilter class which is being instantiated:

C:\Users\john>mofcomp wmi-filter-export.mof
Microsoft (R) MOF Compiler Version 10.0.14393.0
Copyright (c) Microsoft Corp. 1997-2006. All rights reserved.
Parsing MOF file: wmi-filter-export.mof
MOF file has been successfully parsed
Storing data in the repository...
An error occurred while resolving the alias for object 1 defined on lines 2 - 18:
0X80041002 Class, instance, or property 'MSFT_SomFilter' was not found.
Compiler returned error 0x80041002

Just searching the net for the class name MSFT_SomFilter will get you the link of the class documentation on MSDN which conveniently states:

| Namespace |  Root\policy |

So just call mofcomp with the appropriate namespace and see it do the work. You likely will need to run this on your Domain Controller with administrative rights (i.e. elevated).

C:\Users\john>mofcomp -N:root\Policy wmi-filter-export.mof
Microsoft (R) MOF Compiler Version 10.0.14393.0
Copyright (c) Microsoft Corp. 1997-2006. All rights reserved.
Parsing MOF file: wmi-filter-export.mof
MOF file has been successfully parsed
Storing data in the repository...
WARNING: File wmi-filter-export.mof does not contain #PRAGMA AUTORECOVER.
If the WMI repository is rebuilt in the future, the contents of this MOF file will not be included in the new WMI repository.
To include this MOF file when the WMI Repository is automatically reconstructed, place the #PRAGMA AUTORECOVER statement on the first line of the MOF file.
Done!

Note that if a WMI Filter with the same GUID as the one defined by the ID = <GUID> line the .mof already exists, it will be overwritten. If the GUID is not yet in use, a new WMI filter will be created.

The #PRAGMA AUTORECOVER warning has no real substance here - no new classes are being defined by the .mof, so nothing is lost in the case of a WMI repository rebuild.

Related Topic