I have a device collection in SCCM 2012 R2 which uses a query membership rule to automatically provision computers from a specific AD OU into the collection. Incremental updates are enabled for the collection, as well as a full update (weekly). It works fine, however there is just one system that does not get imported (the CEO's laptop, obviously doesn't want to be managed, ironically...). It appears neither in Devices, nor in the collection. If I try to add it using a direct rule, nothing is found. What can I do to troubleshoot this?

Assuming its within an OU included in your AD System Discovery configuration, have you checked the adsysdis.log for this device's name and the results of discovery?

Thanks for referring me to this log file, the device does get discovered:

INFO: discovered object with ADsPath = 'LDAP://B10DC02.DOMAIN.LOCAL/CN=USER214-SST,OU=Computers Administration,OU=All Computers,DC=DOMAIN,DC=local'~  $$<SMS_AD_SYSTEM_DISCOVERY_AGENT><03-23-2015 21:56:14.547-120><thread=7408 (0x1CF0)>
GetIPAddr - Host not found resolving FQDN "USER214-SST.DOMAIN.local".  $$<SMS_AD_SYSTEM_DISCOVERY_AGENT><03-23-2015 21:56:14.547-120><thread=7408 (0x1CF0)>
GetIPAddr - Retry with system name "USER214-SST"...  $$<SMS_AD_SYSTEM_DISCOVERY_AGENT><03-23-2015 21:56:14.547-120><thread=7408 (0x1CF0)>
  $$<SMS_AD_SYSTEM_DISCOVERY_AGENT><03-23-2015 21:56:16.905-120><thread=7408 (0x1CF0)>
ERROR: Machine USER214-SST is offline or invalid.~

It seems that the computer does not register its name with DNS. Of course, I'm going to investigate why, but is this a reason for SCCM not to add the device? Just because it can't resolve the DNS name? I thought all computer objects in the OU should be added regardless of whether they represent actual devices.

Yes, because the system discovery needs to be able to resolve the computer name. See for more information: https://technet.microsoft.com/en-us/library/6a0e2b40-672f-45e1-a12d-6d403ab39780#BKMK_ADSystemDisc

Thanks, then the root of the problem is not related to SCCM.