Hello All,I'm Currently in the final phase in building my SCCM structure. The last step that I have to overcome is defining rolls in SCCM for the Service Desk, Desktop and System Engineers. Access is as follows..Desktop: Full Access to Collections, Software Distribution and Software UpdatesSystem Engineers: Full access to SCCMThe only Group that is causing issues is the Service Desk who is supposed to have the following access:I've created the global group in ad and then added the group membership in sccm.Collections: Advertise, Read, Use Remote ToolsSoftware Distribution: Read, Modify and DistributeMy main probem is in order for the service desk to send Software to individual users they must be able to create a collection for a single user than delete the collection that they have just made. Im fine with doing that but now since they are able to delete collections Im worried that they might delete the pre-defined colections that I've made and now they are also able to see all the pre-define collections made by sccm such as ALL systems All server and so on. I was wondering if there is a way i can hide certain collections. I've tried playing with the scurity right and now its starting to drive me crazy. Can anyone please assist? Thanks

Hello,the reason why I gave create and delete access was because I thought in order to send software distribution to one client it had to be in its own container?

If you (or another administrator) create the software distribution objects - collections, packages, programs and advertisements then servicedesk only need permissions to add a computer to a collection. If you have a query based collection you could (as earlier posted) add the computer to an Active Dreictory group. Then servicedesk don't need to have any permissions in Config Mgr. for distributing software.Kent Agerlund