We have delta discovery enabled for System, User and Group discovery and we support multiple legacy domains. I just added a legacy domain account to one of the AD security groups for an application deployment, it was added to the collection within minutes.
On Fri Dec 12 2014 at 6:16:28 PM Michael McGuire < [email protected]> wrote: > Good to know that we weren't the only ones who had trouble targeting AD > Groups. I just tested your query by creating another collection with that > as a query rule and it works great. > > I was just hoping for something a little cleaner - like adding the AD > group using a direct rule instead of having to create a query rule that > lists the users in the AD Group. > > Thanks for your help. > > > *Michael K McGuire* / Sr Systems Administrator > MS 188-300, Cedar Rapids, IA, 52401 > Phone: 319-263-0328 / VPN: 263-0328 > [email protected] <[email protected]> > www.rockwellcollins.com > > > On Fri, Dec 12, 2014 at 4:44 PM, Sean Pomeroy <[email protected]> > wrote: > >> That's what I meant by my earlier reply. >> We had issues until we queried for the actual members. >> >> select >> SMS_R_USER.ResourceID,SMS_R_USER.ResourceType,SMS_R_USER.Name,SMS_R_USER.UniqueUserName,SMS_R_USER.WindowsNTDomain >> from SMS_R_User where SMS_R_User.UserGroupName = "DOMAIN\\SECURITY GROUP" >> >> On Fri Dec 12 2014 at 5:43:11 PM Daniel Ratliff <[email protected]> >> wrote: >> > They're is a better query to use that will show actual members of the >>> group. I don't have it but can send it over Monday. Don't query for the >>> group, query for the Members of it. >>> >>> >>> -----Original Message----- >>> *From: *Michael McGuire [[email protected]] >>> *Sent: *Friday, December 12, 2014 05:34 PM Eastern Standard Time >>> *To: *[email protected] >>> *Subject: *Re: [mssms] Application Catalog and AD Group >>> >>> Yes, if we add the user accounts themselves to the collection, then the >>> application will show up in the App Catalog. >>> It just seems to be related to AD groups from other domains. >>> >>> >>> *Michael K McGuire* / Sr Systems Administrator >>> MS 188-300, Cedar Rapids, IA, 52401 >>> Phone: 319-263-0328 / VPN: 263-0328 >>> [email protected] <[email protected]> >>> www.rockwellcollins.com >>> >>> >>> On Fri, Dec 12, 2014 at 4:21 PM, Sean Pomeroy <[email protected]> >>> wrote: >>> >>>> Have you tried querying the membership of the group for addition to the >>>> collection as opposed to adding the gorup itself to the collection? >>>> >>>> On Fri Dec 12 2014 at 5:16:22 PM Michael McGuire < >>>> [email protected]> wrote: >>>> >>>>> My account doesn't have any deployments listed in my user properties. >>>>> >>>>> >>>>> The targeted collection itself doesn't actually have any user >>>>> accounts in it - only AD Groups, so my account will never appear in that >>>>> collection. However, the SCCM database does list my DomainB account as a >>>>> member of DomainA\AppUsers. >>>>> >>>>> The deployment is "Available". >>>>> >>>>> >>>>> >>>>> *Michael K McGuire* / Sr Systems Administrator >>>>> MS 188-300, Cedar Rapids, IA, 52401 >>>>> Phone: 319-263-0328 / VPN: 263-0328 >>>>> [email protected] <[email protected]> >>>>> www.rockwellcollins.com >>>>> >>>>> >>>>> On Fri, Dec 12, 2014 at 4:05 PM, Daniel Ratliff <[email protected]> >>>>> wrote: >>>>> >>>>>> If you look up your account in the console do you see the deployments >>>>>> in the properties? Has the collection updated with your account? Is it >>>>>> available or required? >>>>>> >>>>>> -----Original Message----- >>>>>> *From: *Michael McGuire [[email protected]] >>>>>> *Sent: *Friday, December 12, 2014 04:54 PM Eastern Standard Time >>>>>> *To: *[email protected] >>>>>> *Subject: *[mssms] Application Catalog and AD Group >>>>>> >>>>>> We have an application that is deployed to a collection with a >>>>>> specific AD Group listed inside. >>>>>> AppCollection >>>>>> +DomainA\AppUsers >>>>>> >>>>>> My account is a member of a different domain (we'll call it >>>>>> DomainB), we have added my "DomainB\Mike" account to "DomainA\AppUsers" >>>>>> in >>>>>> AD. >>>>>> I have run the following query to determine that SCCM does in fact >>>>>> know that I am a member of that AD Group. >>>>>> SELECT usr.Name0,User_Group_Name0 >>>>>> FROM v_RA_User_UserGroupName ugn >>>>>> inner join v_R_user usr on ugn.ResourceID=usr.resourceid >>>>>> where usr.Name0 like '%mike%' >>>>>> >>>>>> So I know that SCCM knows I'm a member of DomainA\AppUsers, but even >>>>>> after waiting several hours, running the user policy retrieval and the >>>>>> application deployment evaluation cycles, the application is never listed >>>>>> in the Application Catalog. >>>>>> It seems like the App Catalog is working because I can add a >>>>>> collection from DomainB that I am a member of and the application shows >>>>>> up. >>>>>> >>>>>> Even though the account from one domain is in a group in another >>>>>> domain, it seems like it should work as long as SCCM knows that my >>>>>> account >>>>>> is a member of the targeted group in the collection. I hardly ever work >>>>>> with the App Catalog, so I'm probably missing something obvious. >>>>>> >>>>>> I'm still digging into this, but I'm hoping that someone will have >>>>>> some ideas. >>>>>> >>>>>> >>>>>> *Mike* >>>>>> >>>>>> >>>>>> >>>>>> The information transmitted is intended only for the person or entity >>>>>> to which it is addressed >>>>>> and may contain CONFIDENTIAL material. If you receive this >>>>>> material/information in error, >>>>>> please contact the sender and delete or destroy the >>>>>> material/information. >>>>>> >>>>>> >>>>> >>>> >>> >>> >>> The information transmitted is intended only for the person or entity to >>> which it is addressed >>> and may contain CONFIDENTIAL material. If you receive this >>> material/information in error, >>> please contact the sender and delete or destroy the material/information. >>> >>
