GPO-Processing: last statement of a WMI-Filter with 3 queries will be ignored - Problems with multiple queries: Is there any restriction of MS?

Hello!

AD: domain and forest functional level: 2008r2

Clients: w7 prof sp1, TS 2008r2 sp1, xp sp3

I have here a strange behaviour of a WMI-Filter for a GPO. It delivers wrong results and I haven't any idea why.

WMI-Filter consists of 3 simple statements:

select * from Win32_OperatingSystem WHERE (Version LIKE '6.%' AND ProductType >= '1')   --only Vista or later OS

select * from Win32_Computersystem WHERE (Domain != 'inet.ino.com')  --Computerdomain Client

select * from Win32_Environment WHERE (Name = 'Logontype' AND VariableValue != 'Tablet')  --variable for kind of device (PC or Tablet or TS)

Every statement alone delivers the right result. (checked with PS: get-wmiobject -q "select .....)

But the result of the WMI-Filter with all 3 statements delivers a wrong result (TRUE) in case of  the device is a tablet (Logontype=Tablet) and in condition that statement 1 and statement 2 are TRUE. (in this case windows7 and domain=clients.ino.com).

And now the curios issue:

Another WMI-Filter I builded for getting the reason of this behaviour with thesame3 statements but another sequence of the statements ("Logontype" will query here on Position 2) gives me the right result, in the case above FALSE, because "Logontype" = Tablet here.

And a third Filter with the same statements, where "Logontype" will query at Position 1 of the Filter gives me also the right result FALSE.

So I checked these 3 Filters with these statements on other clients. Result: The third statement seems to be ignored everytime. For example. Is the query for the OS (at least VISTA) on Postion 3 I'm getting TRUE for the Filter on a XP-Client. And ckecking theses Filters on a client in the "inet.ino.com"-domain, I get a false TRUE for this filter, which checks the domain with the statement on Postion 3.

So my question:

What am I doing wrong?

Is there any restriction for count of queries in a WMI-Filter (not more than two)?

Can somebody confirm this behaviour?

Best regards!

Peter

PS: The WMI-Filter validator by gpoguy.com shows only the first two statements of my filters