That's the one! Nice Sean. -----Original Message----- From: Sean Pomeroy [[email protected]<mailto:[email protected]>] Sent: Friday, December 12, 2014 05:45 PM Eastern Standard Time To: [email protected] Subject: Re: [mssms] Application Catalog and AD Group
That's what I meant by my earlier reply. We had issues until we queried for the actual members. select SMS_R_USER.ResourceID,SMS_R_USER.ResourceType,SMS_R_USER.Name,SMS_R_USER.UniqueUserName,SMS_R_USER.WindowsNTDomain from SMS_R_User where SMS_R_User.UserGroupName = "DOMAIN\\SECURITY GROUP" On Fri Dec 12 2014 at 5:43:11 PM Daniel Ratliff <[email protected]<mailto:[email protected]>> wrote: They're is a better query to use that will show actual members of the group. I don't have it but can send it over Monday. Don't query for the group, query for the Members of it. -----Original Message----- From: Michael McGuire [[email protected]<mailto:[email protected]>] Sent: Friday, December 12, 2014 05:34 PM Eastern Standard Time To: [email protected]<mailto:[email protected]> Subject: Re: [mssms] Application Catalog and AD Group Yes, if we add the user accounts themselves to the collection, then the application will show up in the App Catalog. It just seems to be related to AD groups from other domains. Michael K McGuire / Sr Systems Administrator MS 188-300, Cedar Rapids, IA, 52401 Phone: 319-263-0328 / VPN: 263-0328 [email protected]<mailto:[email protected]> www.rockwellcollins.com<http://www.rockwellcollins.com> On Fri, Dec 12, 2014 at 4:21 PM, Sean Pomeroy <[email protected]<mailto:[email protected]>> wrote: Have you tried querying the membership of the group for addition to the collection as opposed to adding the gorup itself to the collection? On Fri Dec 12 2014 at 5:16:22 PM Michael McGuire <[email protected]<mailto:[email protected]>> wrote: My account doesn't have any deployments listed in my user properties. The targeted collection itself doesn't actually have any user accounts in it - only AD Groups, so my account will never appear in that collection. However, the SCCM database does list my DomainB account as a member of DomainA\AppUsers. The deployment is "Available". Michael K McGuire / Sr Systems Administrator MS 188-300, Cedar Rapids, IA, 52401 Phone: 319-263-0328<tel:319-263-0328> / VPN: 263-0328 [email protected]<mailto:[email protected]> www.rockwellcollins.com<http://www.rockwellcollins.com> On Fri, Dec 12, 2014 at 4:05 PM, Daniel Ratliff <[email protected]<mailto:[email protected]>> wrote: If you look up your account in the console do you see the deployments in the properties? Has the collection updated with your account? Is it available or required? -----Original Message----- From: Michael McGuire [[email protected]<mailto:[email protected]>] Sent: Friday, December 12, 2014 04:54 PM Eastern Standard Time To: [email protected]<mailto:[email protected]> Subject: [mssms] Application Catalog and AD Group We have an application that is deployed to a collection with a specific AD Group listed inside. AppCollection +DomainA\AppUsers My account is a member of a different domain (we'll call it DomainB), we have added my "DomainB\Mike" account to "DomainA\AppUsers" in AD. I have run the following query to determine that SCCM does in fact know that I am a member of that AD Group. SELECT usr.Name0,User_Group_Name0 FROM v_RA_User_UserGroupName ugn inner join v_R_user usr on ugn.ResourceID=usr.resourceid where usr.Name0 like '%mike%' So I know that SCCM knows I'm a member of DomainA\AppUsers, but even after waiting several hours, running the user policy retrieval and the application deployment evaluation cycles, the application is never listed in the Application Catalog. It seems like the App Catalog is working because I can add a collection from DomainB that I am a member of and the application shows up. Even though the account from one domain is in a group in another domain, it seems like it should work as long as SCCM knows that my account is a member of the targeted group in the collection. I hardly ever work with the App Catalog, so I'm probably missing something obvious. I'm still digging into this, but I'm hoping that someone will have some ideas. Mike The information transmitted is intended only for the person or entity to which it is addressed and may contain CONFIDENTIAL material. If you receive this material/information in error, please contact the sender and delete or destroy the material/information. The information transmitted is intended only for the person or entity to which it is addressed and may contain CONFIDENTIAL material. If you receive this material/information in error, please contact the sender and delete or destroy the material/information. The information transmitted is intended only for the person or entity to which it is addressed and may contain CONFIDENTIAL material. If you receive this material/information in error, please contact the sender and delete or destroy the material/information.
