WMI filter for Internet Explorer 10+

I need to apply a GPO on all machines with IE 10+ but the setting does not need to be and shouldn't be applied to ie 9. All the machines are Windows Vista, 7, and 8 (some 32 bit and others 64).

I found two ways to do it

1. Check the iexplorer.exe version number in c:\program files\internet explorer\
2. Select MicrosoftIE_Summary from \root\cimv2\Applications\MicrosoftIE

The first method seems like a complete hack and probably is not the best way to go about figuring out the version of IE that is actually used by the system (e.g. what about program files x86)

SELECT path,filename,extension,version FROM CIM_DataFile WHERE path="\\Program Files\\Internet Explorer\\" AND filename="iexplore" AND extension="exe" AND version>"8.0"

The second way uses built in WMI namespaces and classes but from what I can tell Microsoft removed the \root\cimv2\Applications\MicrosoftIE namespace from every OS after Windows XP.

root\cimv2\Applications\MicrosoftIE;SELECT * FROM MicrosoftIE_Summary WHERE Version = '8.0.6001.18702'

Does anyone know if there is a new namespace in Windows 7/8 that stores the Internet Explorer version or maybe there's a third way to filter my GPO someone knows about that I haven't found.

Solution 1:

I will qute from Group Policy Guy here: http://sdmsoftware.com/group-policy-blog/group-policy-preferences/gp-preferences-for-internet-explorer-11/

"Within the XML underlying the IE settings in the GPO, they leveraged Item-level targeting (ILT) to ensure the right settings made it to the right version of IE on the client. Specifically, they use a hidden File ILT to check for the version of IExplore.exe running on the client machine and the use that to determine which IE settings to deploy from the GPO"

It looks like Microsoft is also using something similar to #1 option you put up there, and honestly I don't see what's wrong with it.