This week I want to devote a post to managing Approval Requests in ConfigMgr 2012. I’m not going to discuss whether the current model works, or not, I’m just going to say that in general it won’t work. The reason for that is simple, because it’s just one big list for everyone and every single Approval Request. To fill a small gap here, there is the Application Approval Workflow (solution accelerator), but for that also System Center 2012 – Service Manager and – Orchestrator are required. This just doesn’t fill the gap for everyone and/ or every company. So where does this leave us?
Instead of complaining about all this, something that’s in a humans’ nature to do, we can also look at the options that we do get. With ConfigMgr 2012 SP1 we’ve been given PowerShell Cmdlets for ConfigMgr 2012! Many has been written about that already, so here I’m just going to give an example of what can be done with it. What I did was, with some help of PrimalForms Communtiy Edition, create a basic form, with some buttons and a selection box, to manage Approval Requests. The basic idea behind it, is to give somebody a list with users and let him manage the Approval Requests for those users only. By default the form shows all the Approval Requests for a specific user and gives the option to only show the Approval Requests that are waiting for approval. Then the Approval Requests that are still waiting for approval can be either approved, or denied.
Now lets take a look at the cmdlets used for creating a basic form like this. Besides the code used for creating the form, I used the following cmdlets for the actions specified with it. The first I needed to do, was to get a specific list of users. This can be achieved by using the Get-CMUser cmdlet, which can be used to retrieve user objects from a specific collection. As I only needed the SMSID property, I used the following command:
Get-CMUser -CollectionID $CollectionID | Select SMSID
The second thing I needed to do, was to get a list of Approval Requests for a specific user. This can be achieved by using the Get-CMApprovalRequest cmdlet, which can be used to retrieve a list of requests for a specific user. As I only wanted the Application, CurrentState and User properties, I used the following command:
Get-CMApprovalRequest -User $User | Select Application,CurrentState,User
A nice small follow up on this list is that it’s also very easy to create a list of Approval Requests with the state of Requested. This is an small and easy change, because an Approval Request knows the following 4 states:
- 1 – Requested
- 2 – Cancelled
- 3 – Denied
- 4 – Approved
So a list with only Approval Requests, with the state Requested, can be easily achieved with the following command (which is a small change, in query, from the general list):
Get-CMApprovalRequest -User $User | Select Application,CurrentState,User | Where CurrentState -eq 1
The third thing I needed to do, was to create an option to Approve an Approval Requests for a specific user. This can be achieved by using the Approve-CMApprovalRequest cmdlet, which can be used to approve a request for a specific application of a specific user. As it also needs a comment, I used the following command:
Approve-CMApprovalRequest -Application $ApplName -User $User -Comment "Request approved."
The fourth, and also last thing I needed to do, was to create an option to Deny an Approval Requests for a specific user. This can be achieved by using the Deny-CMApprovalRequest cmdlet, which can be used to deny a request for a specific application of a specific user. As it also needs a comment, I used the following command::
Deny-CMApprovalRequest -Application $ApplName -User $User -Comment "Request denied."
This was my first real, but small, PowerShell project in ConfigMgr 2012 and I do have to say that I really like the power of it. It makes it very easy to automate console action. One thing that is important to note is, that it’s also via PowerShell not possible to do something with already approved, or denied Approval Requests.
In case someone wants to see/ have the complete code, I will upload it somewhere next week. For those, that can’t wait, don’t hesitate to contact me.
5 thoughts on “Managing Approval Requests in ConfigMgr 2012”
I was intrigued by this blog because it is a common question that I get in my SCCM Administration class. I have used, and suggested the PowerShell commands as a solution. However, it sounds like your form and code is exactly what I am looking for. Would it be possible to get the complete code from you?
Thanks in advance,
MCT Directions Training Center.
I was planning on posting the script last week already, but there where some “road-bumps”. I hope to post it somewhere between now and a week, so keep an eye on my blog!
Hi, just a quik question:
Would the DENY cmd-let give you the option to effectively “revoke” an earlier approval (so the user can’t reinstall and/or install multiple instances of the application)?
Or is it still impossible to change the status in this way?
It’s not possible to change a previously approved/denied request, not via the console and not via the cmdlets…