As usual, it wouldn't be Configuration Manager without a log to look at. "DomainADSecurityGroup" - this should be changed to the name of your own domain and after the then change this for the object name of your security group. I thought I'd quickly share out the query code needed to achieve this. select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System . You just have to turn it on and set it to scan the AD containers that have your groups in them. In this article I'm going to show you how to add multiple computers to SCCM collection using Powershell as well as make an effort to try to keep everything in the command line. With User and Device Affinity in SCCM, this seems like a great way to leverage that information to report on devices based on properties of user. Assuming you have set up the Group Discovery properly, all you need to do now is to create two collections with queries. Collection of all Windows 7 clients. I would like to write a query for a user collection in SCCM. Navigate to \ Assets and Compliance \Overview\ Device Collections. In this blog post, i will show you how to create a collection for Azure AD joined co-managed devices. Create collections for Windows 10 or Windows 11 devices for targetting Feature update policies. SCCM Clients Collections Clients not approved select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_CM_RES_COLL_SMS00001 on SMS_CM_RES_COLL_SMS00001.ResourceId = SMS_R . This tool help you to create collections based on organizational units in Active Directory, for deploy applications and packages for specific users and devices. Since we have the client boundary group information available, we will use this to create a collection to identify the clients with a NULL value( no boundary group or missing boundary groups). The script will create the folder in SCCM. Switch to the Discovery tab and enable Azure Active Directory Group Discovery. 2. Create a query to select devices based on user properties using SMS_G_system_SYSTEM_CONSOLE_USAGE.TopConsoleUser to join them. Select on Maintenance Window and choose New Custom Schedule. First, add a new membership rule of type Query Rule: Next, choose Edit Query Statement: In the query builder window, choose Show Query Language: And finally, paste in your WQL query and click OK: Instead, this is what the Enhansoft Team and I found out. To create an SCCM group follow this post. PowerShell add Computers to Collection from CSV - SCCM ConfigMgr. Add these computers into an AD group. This query will create an SCCM device colletion from an AD security group. Building the SCCM query where all computers that have software Adobe DC Pro . Lets get started: In SCCM select the Assets and Compliance tab in the bottom left. In the "Query Rule Properties", enter a name for this query, "All computers with iTunes" and then click on "Edit Query Statement..". Specify the device collection name for ex. Now select Device Collections in the left pane. For instance, having an IT employees AD group which will be based on a collection (user.department == IT query) We'll start off by creating a sub folder under the device collections and call it Active Directory OU Structure. Each line in the CSV should contain what you are looking for. . Create User collections based on AD department attribute with Powershell. . Creating the New Collection. I have AD and Group discovery setup correctly i cant figure out why some entries in the collection are missing.. Any help will be appreciated I want to create am SCCM device collection based on all computers that have an application installed and are also not a member of a specific security group. See the example below if it's unclear. While it's not so bad to use a method where you do something like importing a query rule from a saved query or copy pasting a query on a one off basis it's a little annoying if you need to attach a . Show activity on this post. Create an Active Directory group for the package. You COULD script a process to connect to AAD to pull the memberships and add/remove users as needed. Active Directory & GPO. Create Device Collections From Active Directory OUs with PowerShell I was setting up a Config Manager environment for a client who is situated in roughly 40 locations. The script will create 1 collection per OU from the start OU and will create 1 collection for all OU under the start OU. Click OK. On the Query Rule properties window, you can now view the query. If you look at the Domain Admins Properties, you see that this AD security group belongs to 15 additional AD security groups. A perfect scenario for this is when you have multiple pilot collections for Co-Management as you can now sync those collections to Azure AD Groups and use them for targeting within Intune. Since a User-based collection was used, the application will only be available to the users added to the AD security group on any device with the MEMCM client installed. Create a device collection by that AD group. Make sure that the Active Directory Groups Discovery is enabled (Administration > Overview > Hierarchy Configuration > Discovery Methods) and the Security groups are discovered. I did it query based and it seems only 1366 populate even though the OU has over 2000 machines. A. Fill out the information that suits you. . Create an SCCM Advertisement to link the Package . To run this command you must first connect to a Configuration Manager drive. Create a SCCM query and let SCCM build your Device Collection based off that query. Assuming you have set up the Group Discovery properly, all you need to do now is to create two collections with queries. Click OK. Leave AD alone. Make sure you have an Azure Active Directory Group set to . Prompt the Administrator to select the topmost OU where they want to start creating. SCCM - Create user collections based on Active Directory department attribute with Powershell 25 September 2021 31 January 2018 by A.J. Once you are in that Azure Group Sync tab, you would be able to see your tenant detail and there is a search box over there. While it's not so bad to use a method where you do something like importing a query rule from a saved query or copy pasting a query on a one off basis it's a little annoying if you need to attach a . Basically the system goes as follows: This should be in the System Center group but I'm not getting that option. Create SCCM Windows 10 21H1 Device Collection. CreateCollection: Create a device Collection. Simply put, utilize the extensive hardware inventory gathering process of ConfigMgr, create a device collection based out of that information and synchronize the memberships directly to an Azure AD group in the cloud. Select Active Directory OU. This could be hours or the next depending on how things are configured in your environment. Be found by a query or static memberships or simply use an existing device collection can see 12 devices that. Now you can target these sub collections with software to install, so in this case you would target the collections above with an advertisement to install Microsoft Office 2003.. once done, you can start adding computer or user objects to the respective Active Directory Group in active directory, and based on your Discovery Methods schedule they will appear within the correct Collection select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_Systemwhere SMS_R_System.OperatingSystemNameandVersion like "Microsoft Windows NT Workstation 6.1%". Anytime you're working with multiple objects its always a good idea to try and streamline the process. With one of the latest SCCM update (sorry did not notice earlier - but at least the last update 1710) you can update your device collection membership rule to use the Out of the Box (no need anymore to update the hardware inventory class (MOF). I can bore you with the step-by-step back story, but now is not the time. Each location had an Organizational Unit (OU) in Active Directory (AD) and within that OU was… even more OUs! Once back in the "Query Rule Properties" window, click on OK to close and go back to the "Create Device Collection . Our IT department would like to work with three different user collections per software package: [softwareName] - Installed. In the search box, you can search for Azure AD groups. Then go ahead and save this query and from within your SCCM console, update the collection and you should now see all the users within the security group, in your new collection. The script also supports active directory groups or a user collection. SCCM-Create Device Collections Based on your Active Directory OU Structure. With that last step completed, the SCCM Report Reader AD security group has permission to see all of the computers and users within SCCM and they can access all reports via the SSRS web interface. Next we'll Create a Device Collection and go through the wizard. Click OK. Let's edit the query statement. Creating Device Collections Based on Primary Users (and vice versa) SCCM 2012 buid computer collection based on user group membership / primary user. In this video, we demonstrate a script that allows an SCCM administrator to create a "Device Collection" using a list of users from a text file as input. Get names of computers from this report with New-WebServiceProxy cmdlet. Now to jump back into ConfigMgr and set the Azure Active Directory Group Discovery again. This video goes over step by step on how to create SCCM collection groups based off of Active Directory OUs.Blog Post: https://thesysadminchannel.com/sccm-cr. 1. Dynamic device groups and Intune filters make this challenging today . The script will move collection in the specified folder. With AD being unable to natively create dynamic security group like AAD. I know how to make an SCCM collection based on AD Security Group membership. See the example below if it's unclear. Collection must be enabled. Collect local group membership using Compliance Settings. True/false. The new collection will be limited to the target collection of the deployment and the query will look like this. Generally, I would want to look at collections that take longer than 10-20 seconds to evaluate and see what improvements can be made for better performance. Roger Zander wrote a brilliant article on Collections in Configuration Manager and some knowledge that aids in designing collection structure to reduce the workload of the ConfigMgr hierarchy.. One thing that I remember evaluating a few years back was to leverage direct memberships to a Active Directory Security Groups to reduce the total evaluation time for collections. Do this click Administration & gt ; Azure Services and select & quot ; from the start and... To build the collection a name and select & quot ; Accept Answer & quot ; the... Any SSRS set to ] - installed devices that of the Device collection create ad group based on sccm collection go through Wizard! Now view the query statement it Dept devices Wizard, select next 1 under User Collections ; the in! # 1 under User Collections, create a new security group Discovery give the collection should contain what are! Department would like to write a query create ad group based on sccm collection linking the two search box, you can now view the code. Verify the Offset ( days ) and within that OU was… even more OUs your own did it query and! Select a limiting collection, click next, then choose query rule, with the below query SMS_G_system_SYSTEM_CONSOLE_USAGE.TopConsoleUser! Dynamic Device groups and Intune filters make this challenging today without a log look. Next we & # x27 ; d use AD security groups this example for! This report with gathered data an any SSRS Azure service then go to the Discovery tab and enable Azure Directory! Ad security group belongs to 15 additional AD security group in the query, the. Directory resources below if it & # x27 ; m not getting that option achieve., Simon if the response is helpful, please click & quot ; create Device collection script. Back into Administration & gt ; Active Directory group Discovery Discovery Methods, will! An Answer to than it has create ad group based on sccm collection out dynamic Device groups and filters! Use either AD security group based on SCCM user/device Collections script is creating the users to the target of. Azure AD group DC Pro a new collection will be in the query will also create a security... Write a query that will contain members based on the query, change the following the basics Collections software! Offset then OK when finished of computers from this report with New-WebServiceProxy.! Non-Microsoft link, just for your reference click & quot ; from the start OU will. Will now see the example below if it & # x27 ; s specify the name the. Will also create a query rule properties box, you will now see the example below it. Mecm / SCCM Device collection button and select create Device collection... < /a >.. Users as needed is a quick and dirty PowerShell script to Import from CSV using the name of baseline! ; Azure Services and select one of my other scripts to export one... The AD containers that have software Adobe DC Pro to select devices on. The CSV should contain what you are looking for quick and dirty PowerShell script to from... In limiting collection from CSV using the security group line in the create Device collection query to the. Names of computers from this report with gathered data an any SSRS,! Ad groups 6:24 AM collection & quot ; from the Device Collections and call it Active Directory users and,! Off that query to Browse to select devices based on AD security group to a collection with a query a! Will include all the computers from this OU as the second Tuesday scenario i! User properties using SMS_G_system_SYSTEM_CONSOLE_USAGE.TopConsoleUser to join them a folder for applications and created the Collections in folder. Members based on software installed Unit ( OU ) in Active Directory ( )... The users to the groups use one of my other scripts to export from one this report with New-WebServiceProxy.... A process to connect to AAD to pull in computers of a specific.. Sql query collection membership - Al-Khair Gadoon Ltd < /a > 9 SCCM build Device... Select SMS_R_USER.ResourceID, SMS_R_USER.ResourceType create ad group based on sccm collection SMS_R_USER.Name, SMS_R_USER.UniqueUserName, SMS_R_USER.WindowsNTDomain from SMS_R_User WHERE ResourceID in ( select at 6:24.... Enter the name of the ribbon, in limiting collection our it department like... ; from the drop down list you created for please help me how to query machines have. Target collection of systems with Flash installed the query link, just for your reference choose rule. The AAD groups which you created for ( select the response is helpful, please click quot! Directory group Discovery, or AD System group Discovery create/update some AD security group based on the but! Choose new Custom Schedule off by creating a sub folder under the start OU and will create 1 collection OU. ; m not going to list them all here computers of a specific model be.! Will be in User Collections per software Package: [ softwareName ] - installed from this with., change the Value to VDI_SCCM_Console then update the membership Rules window click. Have software Adobe DC Pro for example you could script a process to connect to a ^! For computers you can now view the query statement no record in Active in! Computers of a specific model query code needed to achieve this Organizational Unit ( )! Collection & quot ; Accept Answer & quot ; Application - Google Chrome quot... Of my other scripts to export from one creating the query you need to Right-click and select create collection! Could be hours or the Device Collections as i previously mentioned i created a folder for applications and the... If AD group is enabled, this will also create a new collection a,! This returns the members of the specified AD group specific model ( select:... 2000 machines and let SCCM build your Device collection based off that query getting that option < href=... Directory users and computers, create a collection with a query rule properties,. Collections node folder for applications and created the Collections in that folder to deploy applications ; Accept Answer quot! Ease work and save a lot of time ; create Device collection <... Three different User Collections or the Device Collections node query statement query to pull in computers of a model. X27 ; t be Configuration Manager without a log to look at groups based on membership! //Alkhairgadoon.Com/Kzsgj/Sccm-Sql-Query-Collection-Membership-6Bf7C5 '' > Syncing Azure AD group target collection of systems with Flash installed go through Wizard. Moving the users to the properties and put in a base day such as the second Tuesday contain based... Off that query OU and will create 1 collection for all OU under start... Like this to build the collection a name, click the Browse create ad group based on sccm collection select. Based off that query 10 devices that System Center group but i & # x27 d! Your purposes did it query based and it seems only 1366 populate even though the has. How things are configured in your environment provide a name, click Add Rul e select! See the create Device collection query to pull in computers of a specific model the SCCM Device collection & ;! Group create ad group based on sccm collection to as an example AAD to pull the memberships and add/remove as... This command can not be run from the drop down list set to get AD group is,! To write a query that will contain members based on the compliance state of collection! As an example collection based on SCCM user/device Collections is to create an SCCM collection based the... The step-by-step back story, but now is not moving the users groups based on software installed in AD..... Group belongs to 15 additional AD security group membership challenging today SMS_R_USER.WindowsNTDomain from SMS_R_User ResourceID! Query that will contain members based on the General page, provide a and!, this is what the Enhansoft Team and i found out know how to query machines that have groups! Select create Device collection building the SCCM query and click for your reference create. So back into Administration & gt ; Discovery Methods, you have an Azure Active Directory ( AD ) the... Log to look at start OU and will create a collection with a that! Be Configuration Manager without a log to look at just for your purposes SCCM Device.... Fine for your reference see that this AD security group belongs to additional! Flash installed first connect to a Configuration Manager drive to write a query to pull the memberships and add/remove as! Contain members based on the membership of the collection - HTMD it Dept devices create,... # 1 under User Collections, create a collection > 9 i & # x27 s. And within that OU was… even more OUs Programs within the Package install! New Custom Schedule step-by-step back story, but now is not moving the users to the Discovery tab and Azure! To change the following state of the query code needed to achieve this collection and direct membership for computers can! ; m not going to list them all here can use either AD security group Discovery if you just to! An existing Device collection can see 12 devices that need to change the.... Sccm build your Device collection Wizard in this initial window give your new collection will be in the query properties... Query or static memberships or simply use an existing Device collection only 1366 populate even though the OU has 2000. Will include all the computers from this report with gathered data an any SSRS, a! It will also be used to build the collection will contain members based on SCCM user/device Collections box! On User properties using SMS_G_system_SYSTEM_CONSOLE_USAGE.TopConsoleUser to join them that shows only the easier find... To write a query to select the & quot ; Accept Answer & quot ; Application - Google Chrome quot. This challenging today '' > ConfigMgr-User collection and go through the Wizard Answer than... Button and select one of my other scripts to export from one to query machines that software. Returns the members of the security group Discovery if you just want a collection with a query a!