Monday, February 13, 2012

Group Policy WMI Filter for Virtual Machines

I had a need to apply a Group Policy only to VMware virtual machines. One possible option was to filter on the vendor of the network adapter, which can be determined by looking at the MAC address. The public listing of company ID assignments can be found at IEEE OUI Public Listing and is updated daily. At the time of this writing, VMware has 00-05-69, 00-0C-29, 00-1C-14, and 00-50-65 as their company ID assignments.

This WMI filter should then pickup VMware Virtual Machines:
SELECT * FROM Win32_NetworkAdapter WHERE MACAddress LIKE "00:05:69%" or MACAddress LIKE "00:0C:29%" or MACAddress LIKE "00:50:65%"

Other Virtualization Vendors
Virtual Box: 08-00-27
Parallels: 00-1C-42

PSA: Do not name your Active Directory domain .local!

Please don't do this. The .local TLD is a reserved namespace for MDNS. MDNS is used extensivly by Apple in their Bonjour technology which is built into OS X, and typically finds it's way on to Windows computers via an iTunes installation. If there is ever the possiblity that Macs will be added to your network, do not use .local for your internal TLD. In fact, you really shouldn't be using any reserved namespace for your internal DNS. Trust me, you'll save yourself hours of potential headaches down the road when you don't do this. If you're stuck with this configuration, there are work arounds. None of them are great.

Workaround 1: How to make Mac OS X do dot-local lookups using both multicast and unicast queries
Workaround 2: Mac OSX 10.7 (Lion) Using .local Domain (Centrify DirectControl)