GPO Item-level Target for User Name Patterns

Question

Hi all,

Run into a block and need help

I am implementing changes to GPO so that depending on server name, depends if an AD group is added for access to servers or not.

Thing is, I do not trust the areas that use the platform I help maintain to add specific accounts to the correct AD groups, therefore i want to add an additional measure that if an account starts with a certain letter that it is added to the deny login group, base on server wildcard.

I have tried WMI query in powershell to simulate the query but the user name field is blank, so i cannot rely on this. I have not been able to find another query to tell me the account name that is connected.

is anybody able to assist with such query or another way to make item-level target a user starting with a specific character?

Thank you

Answer 1

Hi JAMES, Clinton,

 

Thank you for posting in Q&A forum.

i want to add an additional measure that if an account starts with a certain letter that it is added to the deny login group.

AD is not able to implement this function, I think this requires you to edit the relevant script to do so.

Some references of WMI for you to refer:

Windows Management Instrumentation - Win32 apps | Microsoft Learn

https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page

Using WMI - Win32 apps | Microsoft Learn

https://learn.microsoft.com/en-us/windows/win32/wmisdk/using-wmi

 

Hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

 

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.