Deploying Software which will not run if part of an AD group

I have been given a task of deploying a piece of software against a few collections however a colleague has setup a security group with computer objects listed.  

Basically what they want is for the advertisment to run against these collections but not to run if the PC is listed within this group.  Is this possible to do?

September 7th, 2015 7:29am

Assuming you are on ConfigMgr 2007, the best way that I can think of if as follows

- Enabled AD System Group Discovery -- this will add group membership information to computer resources in ConfigMgr.

- Create a new collection that includes the members of the "few" other collections you need to target but excludes the system resources that are part of that specific group. You can include the membership of other collections by either copying over the queries and joining them together or directly querying the membership of those other collections in a single query. An example of the later is at http://blog.configmgrftw.com/roll-up-collections/ (although you be using rollup collections so the query given in this post is a rough example).

- Add a subselect to the query to not include members of the group. An example subselect is at http://www.enhansoft.com/blog/how-a-not-equal-to-query-is-processed if you've never used one.

- Target your advert at this new collection.

Free Windows Admin Tool Kit Click here and download it now
September 7th, 2015 9:34am

Jason's suggestion is the way to go.

You'll need both AD System Discovery and AD System Group Discovery (The group discovery gets the list of groups however the system discovery gets the group membership of the machine)

You should also be aware that ConfigMgr 2007 does not update computer group membership as part of the delta discovery component and you will need to wait for the full discovery to update the group membership. (This is due to the way Active Directory handles the memberof attribute).
This means that if your AD Discovery runs a full scan once per day (to frequently is not recommended due to performance impacts), if a machine is added to the group during the day, it will not get excluded until both the AD Discovery runs a full scan and the collection performs an update.


This issue with delta updates is resolved in ConfigMgr

September 8th, 2015 12:55am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics