Divide a collection into multiple smaller collections in ConfigMgr 2012 via PowerShell

This blog post will be about a question that I recently read on a forum and also already got a couple of times with different customers. That question is if it’s possible to simply create multiple smaller collections of one specific collection. This can be useful when a specific deployment has to be deployed in smaller groups then normally. Also, there are already a couple solution available in the community, like the SCCM Collection Splitter by Mickael Ponsot and the Planning an upgrade of an application  by Jörgen Nilsson, but as always, not every solution fits every customer. In my case(s) these solution didn’t fit, as it shouldn’t have to much options and it shouldn’t rely on static properties.

That’s why I created a simple PowerShell script that requires a collection and a number of collections as input. Based on that input this PowerShell script creates collections with random, but equally divided, collection members. The rest of this post will explain this PowerShell script and shows an example.

>> The complete function is available via download here on the TechNet Galleries! <<

Step 1: Get and set the start variables

The first step, like with every other script, is getting and setting variables to work with during the script. The collection name and the number of collections are input variables of this script and based on that input an array with devices will be created. I do this by using the Get-CMDevice cmdlet. Also, the number of devices per collection will be calculated. I do this by using the ceiling method of math. This will make sure that it will always round up, so we don’t have any leftovers after the script. This all together brings me to the following code:

$Devices = Get-CMDevice -CollectionName $CollectionName $NumberOfDevices = $Devices.Count $NumberOfDevicesPerCollection = ` [math]::ceiling($NumberOfDevices / $NummberOfCollections)

Step 2: Create the new collections

The second step is to create the new collections. Starting from this point the script will go through a for-loop for as many times as the number of collections to be created (see the complete script).  To make sure I create unique collections, I use the number of times it went through the for-loop as part of the collection name. Also, I simply use the New-CMDeviceCollection cmdlet to create the collections. This all together brings me to the following code:

$NewCollectionName = "Example Collection $i" New-CMDeviceCollection -Name $NewCollectionName ` -LimitingCollectionName $CollectionName

Step 3: Get and add the collection members

The third step is to get the collections members and to add them to the newly created collections. To be able to select a number of devices I use the Get-Random cmdlet that allows me to just select a specific number of random devices from an array. After that I can simply loop through those devices and create a direct membership rule per device, by using the Add-CMDeviceCollectionDirectMembershipRule cmdlet. This all together brings me to the following code:

$NewDevices = Get-Random -InputObject $Devices ` -Count $NumberOfDevicesPerCollection foreach ($NewDevice in $NewDevices) { Add-CMDeviceCollectionDirectMembershipRule ` -CollectionName $NewCollectionName -Resource $NewDevice }

Step 4 : Prepare for the next collection

The fourth, and last step, is to make all the variables ready for the next round through the for-loop. This means I’ve got to make sure that the devices that are added to the previous collection, are removed from the the array with devices. Also, it’s important to recalculate the number of devices per collection. This is to make sure that I won’t end-up with a really small collection, or, in some cases, a collection without members. This all together brings me to the following code:

$Devices = $Devices | Where-Object { $NewDevices -notcontains $_ } $NumberOfDevicesLeft = $Devices.Count $NummberOfCollectionsLeft = $NummberOfCollections-$i if ($NummberOfCollectionsLeft -gt 0) { $NumberOfDevicesPerCollection = ` [math]::ceiling($NumberOfDevicesLeft / $NummberOfCollectionsLeft) }

Result

At the end there’s nothing better then looking at a successful result. In the following screenshot the script is executed for the All Desktop and Server Clients collection to create four smaller (equally sized) collections.

ExampleCollections

Share

Approve, Block, Unapprove, or Unblock a Client in ConfigMgr 2012 via PowerShell

This blog post will show how to approve, block, unapprove, or unblock clients in ConfigMgr 2012 via PowerShell. Three of these actions, approve, block and unblock, are also accessible via the console, but via PowerShell it is very easy to perform these actions for a whole collections. This creates the possibility to create a custom automatic approval in combination with for example a collection membership. The fourth action, unapprove, is not accessible via the console and only accessible via WMI (with some help of PowerShell).

Solution

In WMI there is the class SMS_Collection, which has the methods ApproveClients and BlockClients. These methods can be used to (un)approve and (un)block clients and they require both the same two parameters. They both require a boolean and an array as input. When the boolean is set to TRUE it will approve, or block, all the clients specified in the array and when the boolean is set to FALSE it will unapprove, or unblock, all the clients in the specified array. This brings us, per action, to the following code snippets:

Approve

Invoke-WmiMethod -Namespace root/SMS/site_$($SiteCode) -Class SMS_Collection ` -Name ApproveClients -ArgumentList @($True,$ClientsArray) -ComputerName $SiteServer

Block

Invoke-WmiMethod -Namespace root/SMS/site_$($SiteCode) -Class SMS_Collection ` -Name BlockClients -ArgumentList @($True,$ClientsArray) -ComputerName $SiteServer

Unapprove

Invoke-WmiMethod -Namespace root/SMS/site_$($SiteCode) -Class SMS_Collection ` -Name ApproveClients -ArgumentList @($False,$ClientsArray) -ComputerName $SiteServer

Unblock

Invoke-WmiMethod -Namespace root/SMS/site_$($SiteCode) -Class SMS_Collection ` -Name BlockClients -ArgumentList @($False,$ClientsArray) -ComputerName $SiteServer

Complete example

Now after we know all the different invoke commands for the different actions, let’s use one of the actions for a complete example. Under here I created a small function to approve all clients in the specified collection. In short, this function creates an empty array, then queries for the CollectionId, then fills the array with all ResourceIds and at the end it will invoke the WMI method ApproveClients with the array as a parameter. This function needs as input the site code, the site server and the collection name.

function Approve-Client { param([string]$SiteCode, [string]$SiteServer, [string]$CollectionName) $ClientsArray = @() $CollectionId = (Get-WmiObject -Class SMS_Collection ` -Namespace root/SMS/site_$($SiteCode) -ComputerName $SiteServer ` -Filter "Name='$CollectionName'").CollectionId $ClientsArray = (Get-WmiObject -Class SMS_CollectionMember_a ` -Namespace root/SMS/site_$($SiteCode) -ComputerName $SiteServer ` -Filter "CollectionId='$CollectionId'").ResourceId Invoke-WmiMethod -Namespace root/SMS/site_$($SiteCode) ` -Class SMS_Collection -Name ApproveClients ` -ArgumentList @($True,$ClientsArray) -ComputerName $SiteServer } Approve-Client "PTP" "PTSRVR02" "Samsung devices"

Share

Update Collection Membership in ConfigMgr 2012 via PowerShell

A few weeks ago I’ve got the question if it is possible to speed-up the collection membership update after a new device was added to the database via my Import Comport Form. The short answer is, of course, yes! As this answer would make a really short blog post, I decided to put some more time in it. My first answer could have been, why can’t you wait on the incremental update cycle. As by default, the Use incremental updates for this collection is selected (and grayed-out) for the All Systems collection and the default Interval for Collection Membership Evaluation is five minutes (see this post for more information).

Solution

Now what can we do when either five minutes takes to long, or the default interval is changed to something longer and we can’t allow access to the ConfigMgr Console and we also don’t want to get called all the time. The answer is, of course, PowerShell! In WMI there is the class SMS_Collection, which has the method RequestRefresh. This method triggers a re-evaluation of the collection memberships and doesn’t require any parameters. The best part is, this can be done with a one-liner! I like short and simple code. All we need is the path to the collection and that brings us to the following code:

Invoke-WmiMethod ` -Path "ROOT\SMS\Site_$($SiteCode):SMS_Collection.CollectionId='$CollectionId'" ` -Name RequestRefresh -ComputerName $SiteServer

Import Computer Form

Somewhere this week, I will post an updated version of my Import Computer Form. This update will include this one-liner to re-evaluate the collection memberships after the new device is added to the database. So whatever  configuration there may be, the collection will be directly updated.

Share

Show Collection Details in ConfigMgr 2012 via PowerShell – Part 5 (Final): The General Information

>> Available via download here on the TechNet Galleries! <<

This week my post will be all about the end result of my series, about showing the Collection Details, of a device, via a PowerShell form. I changed a few small details and added another new tab, with more new information! This new tab shows all the General information about the collections, of which the device is a member. As there is (almost) no more information that can be added, about collection information that affects the device, this will be the last addition to the script/ form. In case someone still misses some important, or logical information, please let me know!

Collection Details Form

This script creates a nice form to show the Collection Details of the specified device. The form shows all of the following information about the collections, of which the device is a member:

  • ShowCollDetaGen09(New!) Tab – General
    • (New!) The Name of the Collections.
    • (New!) The Id of the Collections.
    • (New!) The Limiting Collection of the Collections.
    • (New!) The Last Update of the Collections.
    • (New!) The Last Membership Change of the Collections.
  • Tab – Deployments
    • The Name of the Collections
    • The Name of the targeted Deployments.
    • The State of the targeted Deployments.
    • The Type of the targeted Deployments.
  • ShowCollDetaVar09Tab – Variables
    • The Name of the Collections
    • The Name of the Variable.
    • The Value of the Variable.
    • (Updated!) The Type of the Variable.
  • Tab – Maintenance Windows
    • The Name of the Collections
    • The Name of the Maintenance Window.
    • The Start Time of the Maintenance Window.
    • The Duration of the Maintenance Window.
    • The Recurrence of the Maintenance Window.
    • The Schedule of the Maintenance Window.
    • The Type of the Maintenance Window (including the, in R2, new type, for Software Updates).
    • Whether the Maintenance Window is enabled or not.
  • Tab – Power Management
    • The Name of the Collections
    • The Name of the applied Non-Peak Power Plan.
    • The Name of the applied Peak Power Plan.
    • The Start Time of the applied Peak Power Plan.
    • The End Time of the applied Peak Power Plan.
    • The Wake-up Time of the devices in the Collection.

Note: When there is there is no Limiting Collection, no targeted Deployment, no Deployment State, no Collection Variable, no Maintenance Window, or no Power Plan then the empty field(s) will show N/A (as in Not Applicable).

Usage

This script can be used, either ‘standalone’, or as a right-click option. The command line usage examples can be found in the script and on the download site. To use this script as a right-click action, follow the next steps:

  • Close the Configuration Manager Console.
  • Create the folder C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\XmlStorage\Extensions\Actions\ed9dee86-eadd-4ac8-82a1-7234a4646e62.
  • Create the folder C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\XmlStorage\Extensions\Actions\3fd01cd1-9e01-461e-92cd-94866b8d1f39.
  • Create in both new folders a new XML file with the following content (keep an eye on the location of the PowerShell script, either place it on the location specified with the parameters, or change the location).
<ActionDescription Class="Group" DisplayName="Custom Actions" MnemonicDisplayName="Custom Actions" Description="Custom Actions" SqmDataPoint="53">
    <ShowOn>
        <string>ContextMenu</string>
    </ShowOn>

    <ActionGroups>
        <ActionDescription Class="Executable" DisplayName="Show Collection Details" MnemonicDisplayName="Show Collection Details" Description="Show Collection Details">
            <ShowOn>
                <string>ContextMenu</string>
            </ShowOn>
            <Executable>
                <FilePath>PowerShell.exe</FilePath>
                <Parameters>-ExecutionPolicy ByPass -WindowStyle Hidden "D:\Data\PS_ShowCollectionDetails\ShowCollectionDetails_v0_9p.ps1" -ResourceId "##SUB:ResourceId##" -SiteCode "##SUB:SiteCode##" -SiteServer "##SUB:__Server##"</Parameters>
            </Executable>
        </ActionDescription>
    </ActionGroups>
</ActionDescription>
  • ShowCollDetaRC09Start the Configuration Manager Console.

Availability

As of now this new version of my Collection Details Form is publicly available via the TechNet Galleries. Please let me know what you think of the form and what else you would like to see in it

Share

Show Collection Details in ConfigMgr 2012 via PowerShell – Part 4: The Power Management Settings

PoweManeSettThis week another addition to my series about showing the Collection Details, of a device, via a PowerShell form. This week I added another new tab, with more new information! This new tab show all the information about the applied Power Management settings, that affect the device. It’s also good to know that within the Power Management settings, there is an option Never apply power management settings to computers in this collection and when this option is selected the form will show a row with five times Never. So whenever a device shows a row like that, the other Power Management settings aren’t applicable anymore.

Collection Details Form

This script creates a nice form to show Collection Details of the specified device. At this moment it shows all of the following information about the collections (of which the device is a member):

  • Tab – Deployments
    • The Name of the Collections, of which the device is a member. 
    • The Name of the targeted Deployments.
    • The State of the targeted Deployments.
    • The Type of the targeted Deployments.
  • Tab – Variables
    • The Name of the Collections, of which the device is a member. 
    • The Name of the Collection Variable.
    • The Value of the Collection Variable.
    • The Type of the Variable (for now only Collection Variable).
  • Tab – Maintenance Windows
    • The Name of the Collections, of which the device is a member. 
    • The Name of the Maintenance Window.
    • The Start Time of the Maintenance Window.
    • The Duration of the Maintenance Window.
    • The Recurrence of the Maintenance Window.
    • The Schedule of the Maintenance Window.
    • The Type of the Maintenance Window (including the, in R2, new type, for Software Updates).
    • Whether the Maintenance Window is enabled or not.
  • ShowCollDeta08(NEW!) Tab – Power Management
    • (NEW!) The Name of the Collections, of which the device is a member. 
    • (NEW!) The Name of the applied Non-Peak Power Plan.
    • (NEW!) The Name of the applied Peak Power Plan.
    • (NEW!) The Start Time of the applied Peak Power Plan.
    • (NEW!) The End Time of the applied Peak Power Plan.
    • (NEW!) The Wake-up Time of the devices in the Collection.

Note: When there is there is no targeted Deployment, no Deployment State (like with Client Settings), no Collection Variable, no Maintenance Window, or no Power Plan then the empty field(s) will show a star (*).

Power Plan

The tool will only show the name of the applied Power Management settings. In case there is a need for more information, then it’s good to know that it’s stored in a XML form (like the example under here). For an example of how to work with XML in PowerShell, take a look at an older post here.

<?xml version="1.0" encoding="utf-16"?> <PowerScheme xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" GUID="22B698A7-B734-4107-B5E0-4BD16375F5C2" Name="Balanced (ConfigMgr)" Description="Automatically balances performance with energy consumption on capable hardware (ConfigMgr)"> <PowerSettings> <PowerSetting> <GUID>3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e</GUID> <CurrentACPowerSettingIndex>1200</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>600</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>29f6c1db-86da-48c5-9fdb-f2b67b1f44da</GUID> <CurrentACPowerSettingIndex>3600</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>900</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>0e796bdb-100d-47d6-a2d5-f7d2daa51f51</GUID> <CurrentACPowerSettingIndex>1</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>1</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>7648efa3-dd9c-4e3e-b566-50f929386280</GUID> <CurrentACPowerSettingIndex>1</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>1</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>a7066653-8d6c-40a8-910e-a1f54b84c7e5</GUID> <CurrentACPowerSettingIndex>0</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>0</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>96996bc0-ad50-47ec-923b-6f41874dd9eb</GUID> <CurrentACPowerSettingIndex>1</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>1</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>5ca83367-6e45-459f-a27b-476b1d01c936</GUID> <CurrentACPowerSettingIndex>1</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>1</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>6738e2c4-e8a5-4a42-b16a-e040e769756e</GUID> <CurrentACPowerSettingIndex>1200</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>300</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>9d7815a6-7ee4-497e-8888-515a05f02364</GUID> <CurrentACPowerSettingIndex>0</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>0</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>d8742dcb-3e6a-4b3c-b3fe-374623cdcf06</GUID> <CurrentACPowerSettingIndex>0</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>0</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>637ea02f-bbcb-4015-8e2c-a1c7b9c0b546</GUID> <CurrentACPowerSettingIndex>0</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>2</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>81cd32e0-7833-44f3-8737-7081f38d1f70</GUID> <CurrentACPowerSettingIndex>0</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>0</CurrentDCPowerSettingIndex> </PowerSetting> <PowerSetting> <GUID>bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d</GUID> <CurrentACPowerSettingIndex>1</CurrentACPowerSettingIndex> <CurrentDCPowerSettingIndex>1</CurrentDCPowerSettingIndex> </PowerSetting> </PowerSettings> </PowerScheme>

Usage

This script can be used, either ‘standalone’, or as a right-click option. The command line usage is like this PowerShell.exe -ExecutionPolicy ByPass .\ShowCollectionDetails_v0_8p.ps1 -ResourceId <ResourceId> -SiteCode <SiteCode> -SiteServer <SiteServer>. To see how to use this as a right-click option, have a look at my previous post.

Availability

As of now this new version of my Collection Details Form is publicly available via the TechNet Galleries. Please let me know what you think of the form and what else you would like to see in it.

Share

Show Collection Details in ConfigMgr 2012 via PowerShell – Part 3: The Maintenance Windows

This week another addition to my series about showing the Collection Details, of a device, via a PowerShell form. This week I added another new tab, with more new information! This new tab show all the information about all the Maintenance Windows that affect the device.

Collection Details Form

This script creates a nice form to show Collection Details of the specified device. At this moment it shows all of the following information about the collections (of which the device is a member):

  • Tab – Deployments
    • The Name of the Collections, of which the device is a member. 
    • The Name of the targeted Deployments.
    • The State of the targeted Deployments.
    • The Type of the targeted Deployments.
  • Tab – Variables
    • The Name of the Collections, of which the device is a member. 
    • The Name of the Collection Variable.
    • The Value of the Collection Variable.
    • The Type of the Variable (for now only Collection Variable).
  • ShowCollDeta07(NEW!) Tab – Maintenance Windows
    • (NEW!) The Name of the Collections, of which the device is a member. 
    • (NEW!) The Name of the Maintenance Window.
    • (NEW!) The Start Time of the Maintenance Window.
    • (NEW!) The Duration of the Maintenance Window.
    • (NEW!) The Recurrence of the Maintenance Window.
    • (NEW!) The Schedule of the Maintenance Window.
    • (NEW!) The Type of the Maintenance Window (including the, in R2, new type, for Software Updates).
    • (NEW!) Whether the Maintenance Window is enabled or not.

Note: When there is there is no targeted Deployment, no Deployment State (like with Client Settings), no Collection Variable, or no Maintenance Window then the empty field(s) will show a star (*).

Usage

This script can be used, either ‘standalone’, or as a right-click option. The command line usage is like this PowerShell.exe -ExecutionPolicy ByPass .\ShowCollectionDetails_v0_7p.ps1 -ResourceId <ResourceId> -SiteCode <SiteCode> -SiteServer <SiteServer>. To see how to use this as a right-click option, have a look at my previous post.

Availability

As of now this third version of my Collection Details Form is publicly available via the TechNet Galleries. Please let me know what you think of the form and what else you would like to see in it.

Share

Show Collection Details in ConfigMgr 2012 via PowerShell – Part 2: The Collection Variables

In my previous post I started a new series about showing the Collection Details of a device via a PowerShell form. This week I did some changes to the look-and-feel and added a new tab, with new information!. This new tab show all the information about all Collection Variables that affect the device.

Show Collection Details Form

This script creates a nice form to show Collection Details of the specified device. At this moment it shows all of the following information about the collections (of which the device is a member):

  • ShowCollDeta06Tab – Deployments
    • The Name of the Collections, of which the device is a member. 
    • The Name of the targeted Deployments.
    • The State of the targeted Deployments.
    • The Type of the targeted Deployments.
  • (NEW!) Tab – Variables
    • (NEW!) The Name of the Collections, of which the device is a member. 
    • (NEW!) The Name of the Collection Variable.
    • (NEW!) The Value of the Collection Variable.
    • (NEW!) The Type of the Variable (for now only Collection Variable).

Note: When there is there is no targeted Deployment, or no Deployment State (like with Client Settings), or no Collection Variable, then the empty field(s) will show a star (*).

Usage

This script can be used, either ‘standalone’, or as a right-click option. The command line usage is like this PowerShell.exe -ExecutionPolicy ByPass .\ShowCollectionDetails_v0_6p.ps1 -ResourceId <ResourceId> -SiteCode <SiteCode> -SiteServer <SiteServer>. To see how to use this as a right-click option, have a look at my previous post.

Availability

As of today this second version of my Collection Details Form is publicly available via the TechNet Galleries. Please let me know what you think of the form.

Share

Show Collection Details in ConfigMgr 2012 via PowerShell – Part 1: The Deployments

In my previous post I started with creating a new PowerShell form to show the Collection Membership of a device. Last week I decided that I wanted to do more with it, so I putted it into a new “project” and form. From now on it’s called Collection Details, as that’s what it’s going to show, starting this week with the targeted Deployments. The coming weeks there will be additional parts, to this post and this “project”, with more and more information to be added to the Collection Details.

So what can we all expect from the Collection Details? Well, we all know the Collection Properties per collection, the Collection Details will show a lot of those properties (and more) on a device level. In general it will mean that, on completion, it will show all deployments and settings targeted to a collection and relevant for the device.

Show Collection Details Form

ShowCollDeta05This script creates a nice form to show more Collection Details of the specified device. At this moment it shows all of the following information about the collections (of which the device is a member):

  • The Name of the Collections, of which the device is a member. 
  • The Name of the targeted Deployments.
  • The Type of the targeted Deployments.
  • (NEW!) The State of the targeted Deployments.

Note: When there is there is no targeted Deployment, or no Deployment State (like with Client Settings), then the field will show a star (*).

Usage

This script can be used, either ‘standalone’, or as a right-click option. The command line usage is like this PowerShell.exe -ExecutionPolicy ByPass .\ShowCollectionDetails_v0_5p.ps1 -ResourceId <ResourceId> -SiteCode <SiteCode> -SiteServer <SiteServer>. To see how to use this as a right-click option, have a look at my previous post.

Availability

As of today the first version of my Show Collection Details Form is publicly available via the TechNet Galleries. Please let me know what you think of the form.

Share

Right-Click Option: Showing the Collection Membership of a Resource in ConfigMgr 2012 via PowerShell

DeviPropDeplLast week someone triggered me that it wasn’t possible to ‘just’ see all the collections that a device is a member of. The only thing I could show, and tell, him, at that moment, was the Deployments –tab in the Properties of the device. The problem with this is that it only show the collections, of which the device is a member, with a deployment targeted. So it misses all the collections, either without an deployment targeted, or with client/ antimalware settings targeted. This triggered me to create a small PowerShell script to show the Collection Membership of a specific device in a nice form.

Show Collection Membership Form

ShowCollMemb07This script creates a nice form to show the Collection Membership of the specified device. It shows all the extra information for the following collections:

  • Collections targeted with (all types of) Deployments,
  • Collections targeted with Client Settings,
  • Collections targeted with Antimalware Policies,
  • Collections targeted with nothing!

Usage

This script can be used, either ‘standalone’, or as a right-click option. The command line usage examples can be found in the script and on TechNet (link is provided at the end of this post). To use this script as a right-click action, follow the next steps:

  • Close the Configuration Manager Console.
  • Create the folder C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\XmlStorage\Extensions\Actions\ed9dee86-eadd-4ac8-82a1-7234a4646e62.
  • Create the folder C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\XmlStorage\Extensions\Actions\3fd01cd1-9e01-461e-92cd-94866b8d1f39.
  • Create in both new folders a new XML file with the following content (keep an eye on the location of the PowerShell script, either place it on the location specified with the parameters, or change the location).
<ActionDescription Class="Group" DisplayName="Custom Actions" MnemonicDisplayName="Custom Actions" Description="Custom Actions" SqmDataPoint="53">
    <ShowOn>
        <string>ContextMenu</string>
    </ShowOn>

    <ActionGroups>
        <ActionDescription Class="Executable" DisplayName="Show Collection Membership" MnemonicDisplayName="Show Collection Membership" Description="Show Collection Membership">
            <ShowOn>
                <string>ContextMenu</string>
            </ShowOn>
            <Executable>
                <FilePath>PowerShell.exe</FilePath>
                <Parameters>-ExecutionPolicy ByPass -WindowStyle Hidden "D:\Data\PS_ShowCollectionMembership\ShowCollectionMemberShip_v0_7p.ps1" -ResourceId "##SUB:ResourceId##" -SiteCode "##SUB:SiteCode##" -SiteServer "##SUB:__Server##"</Parameters>
            </Executable>
        </ActionDescription>
    </ActionGroups>
</ActionDescription>

  • RighClicActiStart the Configuration Manager Console.

Availability

As of today my Show Collection Membership Form is publicly available via the TechNet Galleries. Please let me know what you think of the form.

Share

Quickly catch Active Directory Group Membership changes in ConfigMgr 2012

This week my post will be about catching Active Directory Group Membership changes. I choose this subject, because I still see and get questions about how long does it take before a group membership change is active in a collection. The short answer would be, based on default settings, between 1 till 10 minutes. In the rest of this post I will show a longer answer on why it’s like that. The main reasons are that the Delta Discovery and the Incremental Updates are working now.

Configuration

The most important part to quickly catch Active Directory Group Membership changes, is a good configuration. For that two configurations are very important, the Active Directory Group Discovery and the collection settings. To show how, and how fast, it works, I will show it with my Microsoft Office 2013 Security Group and that means the following configuration:

  • ActiDireGrouDiscPropFirst thing is to enable delta discovery. To configure the delta discovery navigate to Administration > Overview > Hierarchy Configuration > Discovery Methods. Now double-click Active Directory Group Discovery to open the Active Directory Grou Discovery Properties and go to the Polling Shedule –tab. Select Enable delta discovery and leave the Delta discovery interval (minutes) default.
    • Note: Delta discovery does NOT work for deleted objects from the Active Directory.
  • Second thing is to configure the collection query and to enable incremental updates on the collection. CollMembRuleTo configure the incremental updates navigate to the collection Properties and then the Membership Rules –tab. Now select Enable Use incremental updates for this collection and add a Query Rule for the members of the Microsoft Office 2013 Security Group. For that add the following query:
    select SMS_R_USER.ResourceID,SMS_R_USER.ResourceType,SMS_R_USER.Name,SMS_R_USER.UniqueUserName,SMS_R_USER.WindowsNTDomain from SMS_R_User where SMS_R_User.UserGroupName = "PETERTEST\\Microsoft Office 2013"
    • Note: To change the interval for incremental updates take a look at this post.

Result

Now making a change to the group membership of the Microsoft Office 2013 Security Group will trigger the following reaction. The first thing that happens, within 5 minutes, is that the Active Directory Group Discovery will start to run. This can be followed in the adsgdis.log and looks like this:ADSecuGrou 

One of the things that this log shows, is that a Data Discovery Record (DDR) was written for group ‘PETERTEST\Microsoft Office 2013’. This DDR looks like this:

| FV° <User Group> BEGIN_PROPERTY <8><Unique Usergroup Name><19><32><PETERTEST\Microsoft Office 2013> END_PROPERTY BEGIN_PROPERTY <0><Usergroup Name><19><32><Microsoft Office 2013> END_PROPERTY BEGIN_PROPERTY <17><Active Directory Organizational Unit><19><64> BEGIN_ARRAY_VALUES <PETERTEST.LOCAL/PETERTEST><PETERTEST.LOCAL/PETERTEST/GROUPS><PETERTEST.LOCAL/PETERTEST/GROUPS/APPLICATION> END_ARRAY_VALUES END_PROPERTY BEGIN_PROPERTY <17><Active Directory Container Name><19><64> BEGIN_ARRAY_VALUES END_ARRAY_VALUES END_PROPERTY BEGIN_PROPERTY <0><Windows NT Domain><19><32><PETERTEST> END_PROPERTY BEGIN_PROPERTY <0><AD Domain Name><19><32><PETERTEST.LOCAL> END_PROPERTY BEGIN_PROPERTY <0><SID><19><64><S-1-5-21-3410556430-1908461509-240868779-1127> END_PROPERTY BEGIN_PROPERTY <0><Object GUID><3><16><0x03E526344A6AEC4889CDCC6DC07A26DE> END_PROPERTY BEGIN_PROPERTY <0><Group Type><8><4><-2147483646> END_PROPERTY AGENTINFO<SMS_AD_SECURITY_GROUP_DISCOVERY_AGENT><PTP><02/23/2013 20:35:01> FEOF FV

After this DDR is processed into the database the next (incremental) collection evaluation will pick up the new member of the Microsoft Office 2013 Security Group as a new member of the collection (PTP00000B). This can be followed in the colleval.log and looks like this:colleval

As my log files show, this whole process took less then a minute. So when a user is added right before the delta discovery starts it can be within a minute that the user is part of the collection. In the most extreme situation when a user is added right after the delta discovery had run and then, when the delta discovery finally runs again, it runs so long that the incremental collection update didn’t pick up the change yet, it takes up two full cycles of, in this sample, 5 minutes. So, also the long answer is between 1 till 10 minutes.

Share