That's what I meant by my earlier reply. We had issues until we queried for the actual members.
select SMS_R_USER.ResourceID,SMS_R_USER.ResourceType,SMS_R_USER.Name,SMS_R_USER.UniqueUserName,SMS_R_USER.WindowsNTDomain from SMS_R_User where SMS_R_User.UserGroupName = "DOMAIN\\SECURITY GROUP" On Fri Dec 12 2014 at 5:43:11 PM Daniel Ratliff <[email protected]> wrote: > They're is a better query to use that will show actual members of the > group. I don't have it but can send it over Monday. Don't query for the > group, query for the Members of it. > > > -----Original Message----- > *From: *Michael McGuire [[email protected]] > *Sent: *Friday, December 12, 2014 05:34 PM Eastern Standard Time > *To: *[email protected] > *Subject: *Re: [mssms] Application Catalog and AD Group > > Yes, if we add the user accounts themselves to the collection, then the > application will show up in the App Catalog. > It just seems to be related to AD groups from other domains. > > > *Michael K McGuire* / Sr Systems Administrator > MS 188-300, Cedar Rapids, IA, 52401 > Phone: 319-263-0328 / VPN: 263-0328 > [email protected] <[email protected]> > www.rockwellcollins.com > > > On Fri, Dec 12, 2014 at 4:21 PM, Sean Pomeroy <[email protected]> > wrote: > >> Have you tried querying the membership of the group for addition to the >> collection as opposed to adding the gorup itself to the collection? >> >> On Fri Dec 12 2014 at 5:16:22 PM Michael McGuire < >> [email protected]> wrote: >> >>> My account doesn't have any deployments listed in my user properties. >>> >>> The targeted collection itself doesn't actually have any user accounts >>> in it - only AD Groups, so my account will never appear in that >>> collection. However, the SCCM database does list my DomainB account as a >>> member of DomainA\AppUsers. >>> >>> The deployment is "Available". >>> >>> >>> >>> *Michael K McGuire* / Sr Systems Administrator >>> MS 188-300, Cedar Rapids, IA, 52401 >>> Phone: 319-263-0328 / VPN: 263-0328 >>> [email protected] <[email protected]> >>> www.rockwellcollins.com >>> >>> >>> On Fri, Dec 12, 2014 at 4:05 PM, Daniel Ratliff <[email protected]> >>> wrote: >>> >>>> If you look up your account in the console do you see the deployments >>>> in the properties? Has the collection updated with your account? Is it >>>> available or required? >>>> >>>> -----Original Message----- >>>> *From: *Michael McGuire [[email protected]] >>>> *Sent: *Friday, December 12, 2014 04:54 PM Eastern Standard Time >>>> *To: *[email protected] >>>> *Subject: *[mssms] Application Catalog and AD Group >>>> >>>> We have an application that is deployed to a collection with a specific >>>> AD Group listed inside. >>>> AppCollection >>>> +DomainA\AppUsers >>>> >>>> My account is a member of a different domain (we'll call it DomainB), >>>> we have added my "DomainB\Mike" account to "DomainA\AppUsers" in AD. >>>> I have run the following query to determine that SCCM does in fact know >>>> that I am a member of that AD Group. >>>> SELECT usr.Name0,User_Group_Name0 >>>> FROM v_RA_User_UserGroupName ugn >>>> inner join v_R_user usr on ugn.ResourceID=usr.resourceid >>>> where usr.Name0 like '%mike%' >>>> >>>> So I know that SCCM knows I'm a member of DomainA\AppUsers, but even >>>> after waiting several hours, running the user policy retrieval and the >>>> application deployment evaluation cycles, the application is never listed >>>> in the Application Catalog. >>>> It seems like the App Catalog is working because I can add a >>>> collection from DomainB that I am a member of and the application shows up. >>>> >>>> Even though the account from one domain is in a group in another >>>> domain, it seems like it should work as long as SCCM knows that my account >>>> is a member of the targeted group in the collection. I hardly ever work >>>> with the App Catalog, so I'm probably missing something obvious. >>>> >>>> I'm still digging into this, but I'm hoping that someone will have >>>> some ideas. >>>> >>>> >>>> *Mike* >>>> >>>> >>>> >>>> The information transmitted is intended only for the person or entity >>>> to which it is addressed >>>> and may contain CONFIDENTIAL material. If you receive this >>>> material/information in error, >>>> please contact the sender and delete or destroy the >>>> material/information. >>>> >>>> >>> >> > > > The information transmitted is intended only for the person or entity to > which it is addressed > and may contain CONFIDENTIAL material. If you receive this > material/information in error, > please contact the sender and delete or destroy the material/information. >
