EmailRSS

Monthly Archives: May 2019

Syncing SCCM Collections to AD Security Groups

Posted on by

Building SCCM collections and syncing members to an AD security group opens a multitude of new management options for you. For example:

You can improve Group Policy processing time by eliminating WMI filters.[note]Sync OS version collections to a security group to remove the need for an OS WMI filter or sync a laptop collection to a security group to target offline file/wireless settings without WMI.[/note]

or

You could query information about installed software and add computers to security groups that enforce Group Policy Administrative templates for those applications.

To get started with syncing SCCM collections, open the SCCM console. In the top left, select the down arrow and choose Connect via Windows PowerShell ISE.

A new PowerShell ISE window should open with about 30 lines of code. Scroll to the very bottom and add a few blank lines.

Paste in the following:

#Sync SCCM Collections to AD Security Groups

#YOUR COLLECTION NAME HERE
$CollectionMembers = Get-CMDevice -CollectionId COLLECTIONID| Select -Property Name | Sort-Object Name
foreach ($CollectionMember in $CollectionMembers) {
    $Member = Get-ADComputer $CollectionMember.name
    Add-ADGroupMember -Identity "SECURITY GROUP NAME" -Members $Member.ObjectGUID -verbose
}

Find your collection ID in the SCCM console and add it on the $CollectionMembers line. Put your security group name on the Add-ADGroupMember line. Copy and paste those last 5-6 lines for each collection that needs to be synced to AD.

Setup this script to run as a scheduled task. The computer running this script will need the RSAT Active Directory PowerShell module installed and the SCCM PowerShell module. Be sure that the user running your task can both read the SCCM collection members and write to the specified AD groups. I like saving this script to a Scripts folder on the Primary site and setting it to run every few hours. I also recommend adding a note to the AD security group that members are synced from SCCM – this will avoid a lot of confusion for people later![note]Ask me how I know.[/note]

Let me know how you plan on using this script or if you have any issues when syncing SCCM to AD.

SCCM Device Collections for Primary User Groups

Posted on by

Would you like an automated way to group computers by the role of their primary user? For example, do you want a collection that shows all the primary staff computers and another that shows all shared computers in your environment?

If you already have AD security groups for any group of users, you can quickly create a SCCM collection containing the primary computers belonging to those users. You can also create the inverse for any of these. Here is how the collection query language would look that shows the primary computers for the group DOMAIN\\GROUPNAME

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System    LEFT JOIN SMS_UserMachineRelationship ON       SMS_UserMachineRelationship.ResourceID = SMS_R_System.ResourceId        WHERE SMS_UserMachineRelationship.UniqueUserName IN    (SELECT SMS_R_User.UniqueUserName      FROM SMS_R_User     WHERE SMS_R_User.SecurityGroupName = 'DOMAIN\\GROUPNAME')

To use this, just specify the group name on the very last line.

Let’s say you work in education and want a collection showing all staff computers, all student computers, and computers that are used by generic users/non staff or student users). You would create three collections. The first two would use the collection query language from above. You would set the SMS_R_User.SecurityGroupName value for a staff group in the first collection and a student group in the second collection. The third collection would include all computers and exclude these two other collections.

With those three collections, you could do a couple of extra things like:

  • Export the collection members to AD security groups.
  • Sort computers into sub-OUs automatically based on their primary user.

Because this data updates within SCCM automatically, you don’t have to worry about the administrative overhead of updating them. Hopefully, this type of hybrid collection will make your environment a bit easier to manage!