How to Apply GPO through WMI filtering

Solution 1:

Catering sounds like a nice easy way to group machines / users, so in this instance, I would suggest that it would be much more transparent and maintainable to apply this to a Catering OU (Or OU's) or a Catering security group.

Leave WMI filters for when you have no choice. In my experience, they're rarely used because there is generally a better way forward.

Solution 2:

I'm not a programmer so don't take what I say below as gospel, you should check over at SO if you want confirmation, but I can't find a single WMI property for department that you can use to filter off of:

The CLOSEST I can find in the WMI namespace are the Win32_NetworkLoginProfile or Win32_UserAccount but they don't have a DEPARTMENT property in its class.

IF your GPO is using GPPs you can set up an LDAP query and do selective GPP targeting using that query: http://technet.microsoft.com/en-us/library/cc753205.aspx

Other than that...Dan's choice works.