I'm currently undergoing a new SCCM implementation and do not have the client rolled out to all systems yet. So far, I'm about half-way done and need a way to segment out all of the systems that I know are online so that I can push the client to them instead of needlessly pushing to systems that I know are not online or are just stale objects in AD that haven't been online for some time. I setup a collection query that displays all of the PCs that have initiated a heartbeat discovery but it's only about half of the amount of systems in the database. I know there's got to be more systems online than that. I've seen queries based on last hardware scan and other methods but these all need to have the client installed. These may help out in the future but for now I need a way to get online systems so that I can get the client to them. I've also added the AD attribute lastlogontimestamp and it is discovering just fine. I used this attribute because it's replicated across all of the DCs, but it's in nanoseconds and I'm having a hard time setting up a collection query for this.

There's no way to do this... You can only query for data that's in the DB and until the client is installed there's almost no data in the DB. You may want to use Collection Commander, it's a pretty cool utility that integrates with the console (kind of) and will allow you to see which machines are online via a mass ping.http://sourceforge.net/projects/smscollctr/Scott Gill SCCM Consultant

Ok, that's true I never thought of using that entry before. However, WQL is somewhat flawed, not everything you can do in SQL can be done with WQL, and the data it can access is also somewhat limited. There is however, a possibility to make this happen. SCCM collections allow you only to edit the WQL, but on the backend SCCM converts that into SQL before actually querying the database. You have to manually edit one of the entries in the Collection_Rules_SQL table to see the SQL code after conversion. You should know, this method is not supported, however, here is an article on the subject that will give you more detail:http://www.myitforum.com/articles/1/view.asp?id=5578Scott Gill SCCM Consultant

Nice article, Scott. This may do the trick.

perhaps this is of any value to you? http://social.technet.microsoft.com/Forums/en/configmgrsum/thread/81ce496d-9a11-446f-91cf-c89d67f88cbfCheck out my blog at www.sylvari.org/blog

Stupid question here I am sure but.... Why don't you just cleanup AD first?Plus pushing the client to computers that are offline isn't that intense to the server, the ccr gets process and stuck in retry pretty quickly. I usually just go remove them from retry once they are there so they don't try over and over.John Marcum | http://www.TrueSec.com/en/Training.htm | http://myitforum.com/cs2/blogs/jmarcum

Ok, that's true I never thought of using that entry before. However, WQL is somewhat flawed, not everything you can do in SQL can be done with WQL, and the data it can access is also somewhat limited. There is however, a possibility to make this happen. SCCM collections allow you only to edit the WQL, but on the backend SCCM converts that into SQL before actually querying the database. You have to manually edit one of the entries in the Collection_Rules_SQL table to see the SQL code after conversion. You should know, this method is not supported, however, here is an article on the subject that will give you more detail:http://www.myitforum.com/articles/1/view.asp?id=5578 Scott GillSCCM Consultant That post just made my day.Scott,Have you used that method (the backend SQL modification for collection criteria)? I do not like touching the database in our production, but was messing with the SQL TOP function in my development space and could really use this in production, just a little scared to mess with the DB in prod.one good use: Show me all systems that do not have the top five anti-virus DAT versions. Since these get updated multiple times throughout the day sometimes, it would be nice to know who isn't at current levels without having to constantly modify collecitons and monitor the EPO server. nick

Kim,Have you used that method (the backend SQL modification for collection criteria)? I do not like touching the database in our production, but was messing with the SQL TOP function in my development space and could really use this in production, just a little scared to mess with the DB in prod.one good use: Show me all systems that do not have the top five anti-virus DAT versions. Since these get updated multiple times throughout the day sometimes, it would be nice to know who isn't at current levels without having to constantly modify collecitons and monitor the EPO server. nick I have used it in production many times. There's just too many more things that can be done to not use that method. Only thing you have to watch out for when using TOP is don't execute something based on a collection using TOP unless you expire the advertisement shortly after. I did this once and ended up installing AV to a "pilot" of 50 per day over a weekend which ended up being 200 by the time I got back on Monday (didn't think it through). Fortunately, it wasn't that big of a deal for us, but it's just something to keep in mind.Two more general tips I'd give you for using this method:1) Always execute the SQL query in SQL Server Management Studio first to make sure it works.2) Never assign an advertisement to the collection until AFTER you have confirmed the collection looks good.Scott Gill SCCM Consultant

(edited my previous post)Thanks Scott, that's good info.nick