Good to know that we weren't the only ones who had trouble targeting AD Groups. I just tested your query by creating another collection with that as a query rule and it works great.
I was just hoping for something a little cleaner - like adding the AD group using a direct rule instead of having to create a query rule that lists the users in the AD Group. Thanks for your help. *Michael K McGuire* / Sr Systems Administrator MS 188-300, Cedar Rapids, IA, 52401 Phone: 319-263-0328 / VPN: 263-0328 [email protected] <[email protected]> www.rockwellcollins.com On Fri, Dec 12, 2014 at 4:44 PM, Sean Pomeroy <[email protected]> wrote: > That's what I meant by my earlier reply. > We had issues until we queried for the actual members. > > select > SMS_R_USER.ResourceID,SMS_R_USER.ResourceType,SMS_R_USER.Name,SMS_R_USER.UniqueUserName,SMS_R_USER.WindowsNTDomain > from SMS_R_User where SMS_R_User.UserGroupName = "DOMAIN\\SECURITY GROUP" > > On Fri Dec 12 2014 at 5:43:11 PM Daniel Ratliff <[email protected]> > wrote: > >> They're is a better query to use that will show actual members of the >> group. I don't have it but can send it over Monday. Don't query for the >> group, query for the Members of it. >> >> >> -----Original Message----- >> *From: *Michael McGuire [[email protected]] >> *Sent: *Friday, December 12, 2014 05:34 PM Eastern Standard Time >> *To: *[email protected] >> *Subject: *Re: [mssms] Application Catalog and AD Group >> >> Yes, if we add the user accounts themselves to the collection, then the >> application will show up in the App Catalog. >> It just seems to be related to AD groups from other domains. >> >> >> *Michael K McGuire* / Sr Systems Administrator >> MS 188-300, Cedar Rapids, IA, 52401 >> Phone: 319-263-0328 / VPN: 263-0328 >> [email protected] <[email protected]> >> www.rockwellcollins.com >> >> >> On Fri, Dec 12, 2014 at 4:21 PM, Sean Pomeroy <[email protected]> >> wrote: >> >>> Have you tried querying the membership of the group for addition to the >>> collection as opposed to adding the gorup itself to the collection? >>> >>> On Fri Dec 12 2014 at 5:16:22 PM Michael McGuire < >>> [email protected]> wrote: >>> >>>> My account doesn't have any deployments listed in my user properties. >>>> >>>> The targeted collection itself doesn't actually have any user >>>> accounts in it - only AD Groups, so my account will never appear in that >>>> collection. However, the SCCM database does list my DomainB account as a >>>> member of DomainA\AppUsers. >>>> >>>> The deployment is "Available". >>>> >>>> >>>> >>>> *Michael K McGuire* / Sr Systems Administrator >>>> MS 188-300, Cedar Rapids, IA, 52401 >>>> Phone: 319-263-0328 / VPN: 263-0328 >>>> [email protected] <[email protected]> >>>> www.rockwellcollins.com >>>> >>>> >>>> On Fri, Dec 12, 2014 at 4:05 PM, Daniel Ratliff <[email protected]> >>>> wrote: >>>> >>>>> If you look up your account in the console do you see the deployments >>>>> in the properties? Has the collection updated with your account? Is it >>>>> available or required? >>>>> >>>>> -----Original Message----- >>>>> *From: *Michael McGuire [[email protected]] >>>>> *Sent: *Friday, December 12, 2014 04:54 PM Eastern Standard Time >>>>> *To: *[email protected] >>>>> *Subject: *[mssms] Application Catalog and AD Group >>>>> >>>>> We have an application that is deployed to a collection with a >>>>> specific AD Group listed inside. >>>>> AppCollection >>>>> +DomainA\AppUsers >>>>> >>>>> My account is a member of a different domain (we'll call it >>>>> DomainB), we have added my "DomainB\Mike" account to "DomainA\AppUsers" in >>>>> AD. >>>>> I have run the following query to determine that SCCM does in fact >>>>> know that I am a member of that AD Group. >>>>> SELECT usr.Name0,User_Group_Name0 >>>>> FROM v_RA_User_UserGroupName ugn >>>>> inner join v_R_user usr on ugn.ResourceID=usr.resourceid >>>>> where usr.Name0 like '%mike%' >>>>> >>>>> So I know that SCCM knows I'm a member of DomainA\AppUsers, but even >>>>> after waiting several hours, running the user policy retrieval and the >>>>> application deployment evaluation cycles, the application is never listed >>>>> in the Application Catalog. >>>>> It seems like the App Catalog is working because I can add a >>>>> collection from DomainB that I am a member of and the application shows >>>>> up. >>>>> >>>>> Even though the account from one domain is in a group in another >>>>> domain, it seems like it should work as long as SCCM knows that my account >>>>> is a member of the targeted group in the collection. I hardly ever work >>>>> with the App Catalog, so I'm probably missing something obvious. >>>>> >>>>> I'm still digging into this, but I'm hoping that someone will have >>>>> some ideas. >>>>> >>>>> >>>>> *Mike* >>>>> >>>>> >>>>> >>>>> The information transmitted is intended only for the person or entity >>>>> to which it is addressed >>>>> and may contain CONFIDENTIAL material. If you receive this >>>>> material/information in error, >>>>> please contact the sender and delete or destroy the >>>>> material/information. >>>>> >>>>> >>>> >>> >> >> >> The information transmitted is intended only for the person or entity to >> which it is addressed >> and may contain CONFIDENTIAL material. If you receive this >> material/information in error, >> please contact the sender and delete or destroy the material/information. >> > >
