Delegate Permissions for a Group or User on a WMI Filter
Applies To: Windows Server 2008
To delegate permissions for a group or user on a WMI filter
In the Group Policy Management Console (GPMC) console tree, click the WMI filter for which you want to delegate permissions.
In the results pane, click the Delegation tab.
Click Add.
In the Select User, Computer, or Group dialog box, click Object Types, select the types of objects to which you want to delegate permissions on the WMI filter, and then click OK.
Click Locations, select either Entire Directory or the domain or organizational unit containing the object to which you want to delegate permissions, and then click OK.
In the Enter the object name to select box, type the name of the object to which you want to delegate permissions by doing one of the following:
If you know the name, type it and then click OK.
To search for the name, click Advanced, type the search criteria, click Find Now, select the name in the list box, click OK, and then click OK again.
In the Add Group or User dialog box, in the Permissions box, select the permissions level you want to assign to the group or user, and then click OK.
Additional considerations
You must have Full Control permissions on a WMI filter to change its permissions.
You cannot remove or change inherited permissions for WMI filters.
All users must have Read access to all WMI filters. Otherwise, Group Policy stops processing when it encounters a WMI filter that cannot be read.
You cannot use the GPMC to remove Read permissions from WMI filters.
WMI Filters are available if at least one domain controller in the domain is running Microsoft Windows Server 2003 or later.
You can also use the delegation tab to change or remove permissions for a group or user for WMI filters.