Create new Windows collections based on Query rules

Collections in ConfigMgr can be used for dynamic view. This will happen when a Query rule is used, based on Operating Systems or Active Directory containers (for example). There are a few blogs which describes this functionality already:

How to create a query based on Direct membership is described here:

• How to create or change new Windows collections in ConfigMgr

How to configure ConfigMgr collections to Active Directory containers is described here:

• Creating dynamic collections in ConfigMgr
• Configure dynamic collections in ConfigMgr
• Query ConfigMgr collections with Active Directory

In this blog I will describe how to create a new collection with Query rule.

First create a new collection in ConfigMgr and choose Membership rules based on Query rule. Click the [yellow database icon] and choose the query explained below. Choose "Dynamically add new resources" when using ConfigMgr R3 to automatically add new devices.

In this case I'm using a Resource class based on System Resource and  "Edit Query Statement" for creating a new Query rule.

Select the Criteria tab and the [yellow star icon] for that. Click "Select" afterwards.

In this case I'm using a Attribute class based on System Resource and a  Attribute based on "Operating System Name and Version".

When choose OK in the screen before (Select Attribute) the above screen will be displayed. Choose [Operator: Is Like] and Value based on Operating System variable here.

When choose OK in the screen before (Criterion Properties) the above screen will be displayed. Click OK afterwards.

The new collection with Query rule is ready now. All Windows 7 systems (in my case) will be automatically added in this new collection.

For new Windows releases use the following queries:
 

• Windows Vista: Value = %Workstation 6.0%
• Windows 7: Value = %Workstation 6.1%
• Windows 8: Value = %Workstation 6.2%
• Windows Server 2008: Value = %Server 6.0%
• Windows Server 2008 R2: Value = %Server 6.1%
• Windows Server 8: Value = %Server 6.2%

That way it's possible to create new collections with support on new Operating Systems. I will add support for new Operating Systems later when available.

How to create or change new Windows collections in ConfigMgr

By default there are 17 collections in ConfigMgr. Most of them will never be used, so they can be moved as subcollection for overview reasons. How to do that is described here: Move default collections in ConfigMgr 2007. That way collections for Windows 2000, Mobiles devices and Windows XP (for example) will be out of sight in collections overview.

Collections that can be moved (in my case) are:

Most of times I create a "_Unused Microsoft Collections" collection to move old/not used collections too. That way the Collection ID and used query will retained. Now it's time to create new collections or change existing collection queries. This for new Operating Systems like Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 (for example). The steps needed for that I will describe here.

First create a new collection in ConfigMgr and choose Membership rules based on direct membership. Click the [blue computer icon] and choose the query explained below. In this case I'm using a Resource class based on System Resource and a Attribute name based on "Operating System Name and Version". Choose "Dynamically add new resources" when using ConfigMgr R3 to automatically add new devices.

Furthermore don't use Collection limiting and select resources needed when displayed. Otherwise the query will not be saved. Then choose Finish, Next (3x) and Finish to save the new collection with query created. To change an existing collection query, choose collection properties, go to Membership Rules, edit the query, choose "Edit Query statement" and Criteria. Then choose edit to change the existing query.

For new Windows releases use the following queries:

• Windows Vista: Value = %Workstation 6.0%
• Windows 7: Value = %Workstation 6.1%
• Windows 8: Value = %Workstation 6.2%
• Windows Server 2008: Value = %Server 6.0%
• Windows Server 2008 R2: Value = %Server 6.1%
• Windows Server 8: Value = %Server 6.2%

That way it's possible to create new collections with support on new Operating Systems. I will add support for new Operating Systems later when available.

Move default collections in ConfigMgr 2007

When installing ConfigMgr 2007, there are many default collections in the console. Most collections will be never used actually. Only the "All Systems" is handy for recognizing all devices. Best thing is to move the default collections to a new collection. How this works I will explain in this blog.

In ConfigMgr 2007 there are 17 default collections after installation. In ConfigMgr 2012 there will be default 2 User collections and 5 Device collections. Much better that way!

Because all these collections are filling up the console, it's better to moves the ones not using. To do this create a new collection (for example: All Microsoft collections). Now right-click on this collection, and choose New - Link to collection. Browse for the collection you want to move, and choose OK. This will copy the collection (and query) to the new collection.

Do this for every collection that's not used. Most of times only the "All Systems" collection is handy for use. The other collections becomes sub-collections of the new "All Microsoft collections" collection (and will be still available afterwards)! Delete the original collections after copying, these are not necessary anymore. In my console it will looks like this (after copying and deleting):

Beneath "All Microsoft collections" and "Software Distribution" are my sub-collections. The first for moved default collections, and the second for all Applications that are bound to user groups. That way the console is clear of collections that are not used often!

The moved collections can still be used for advertisements, so don't worry about that. It's only handy for a clear view in ConfigMgr 2007.

Query ConfigMgr collections with Active Directory

When I'm implementing ConfigMgr 2007 at customers, default collections are almost not used. Only the "All Systems" is handy for recognizing devices. Mostly I create collections for existing or new Active Directory OU's. (for example: Desktops, Laptops, VDI). When devices are placed in this OU's you can browse for this. Use "Active Directory System Group Discovery" for that, and the query can be created.

Read the blog: "Configure dynamic collections in ConfigMgr" for a complete guide to create dynamic collections.
http://henkhoogendoorn.blogspot.com/2011/01/configure-dynamic-collections-in.html

But what to do when there are no devices found in OU's, or worst, the OU's doesn't yet exist? In that case you cannot browse for this, so queries must be manually filled in. If you are specifying a full path, the FQDN of the Active Directory domain and a path to the OU is used to locate the OU in question.

So, in my example, the path is "SYSTEMCENTER.COM/VIRTUAL MACHINES" for the OU. With this information it's not needed to link ConfigMgr collections to existing Active Directory OU's anymore!

Configure dynamic collections in ConfigMgr

After the success of my first blog "Creating dynamic collections in ConfigMgr" (most pageviews on this blog), I will write a follow-up on this item. It seems that many people are searching on this specific item, because there are no dymanic collections based on AD discovery data when installing ConfigMgr 2007. In this blog I will describe exactly what to do for having dynamic configuration. It must work this way!

First create new collections for all places there are systems in Active Directory OU's. When you have different OU's for desktops, laptops & specials for meaning, create collections for that systems also. It is also possible to bound user groups to it, which are useful for application deployment. I will write a new blog for App-V packages in ConfigMgr 2007 later on. On all of the collections you have the choice to configure systems or users/user groups.

  
I have created an "Virtual Machines" OU first. Now start a "Active Directory System Group Discovery". This can be found at Site Management > Site Server > Site Settings > Discovery Methods. This System Group Discovery must have the following settings: "Enable Active Directory System Group Discovery".

Choose the yellow star, and add the domain you are working with. In my case this is SystemCenter.com. First choose for the default AD settings: Local domain and Recursive will be default selected. It is also possible for selecting an specific OU, instead of complete discovery (see options below).

• Local domain: Browse for AD containers in the domain where the computer running the Configuration Manager 2007 console resides.
• Custom LDAP: Indicates that you want to browse for Active Directory containers. This option activates Browse.
• Recursive: Default. When selected, indicates that AD discovery searches child containers. Otherwise, child containers are not searched.
• Include groups: Not default. When selected, Active Directory discovery discovers objects within groups.

When choosing for Local domain (default option), the above screenshot will be displayed. Choose the Domainname for searching in all containers. The OU's with systems in it will be automatically recognized. (It is also possible for selecting an specific OU, instead of complete discovery).

On the tab "Polling Schedule" you can change the schedule option from 1 day to 1 hour or lower (best practice when using ConfigMgr 2007 R2). This because otherwise new Active Directory OU's will be synchronized once a day. With ConfigMgr 2007 R3 this is not needed anymore, so it doesn't have to be changed.

New in ConfigMgr 2007 R3 is "Enable delta discovery" which is default set on 5 minutes. This setting doesn't have to be changed, because this performs an intermediate discovery cycle adding only new resources to the ConfigMgr database. Choose also "Run full discovery as soon as possible" for recognizing Active Directory OU's immediately.

On the tab "Membership Rules" you can change the schedule option from 1 day to 1 hour or lower (best practice when using ConfigMgr 2007 R2). This because otherwise new systems will be synchronized to collections once a day. With ConfigMgr 2007 R3 this is not needed anymore, so it doesn't have to be changed.

New in ConfigMgr 2007 R3 is "Dynamically add new resources" which is default off. Choose to turn it on, because this allows you to more rapidly evaluate a collection membership by adding only newly discovered resources. Now open collection properties (in my case Virtual Machines), and click on the yellow (database) icon.

Give the query a name (in my case Virtual Machines) and choose for "Edit Query Statement". Let the option "Collection limiting" at default (Not collection limited), because when choosing "Limit to collection" not all the systems can be found.

When select OK a new windows will be opened. On the tab "Criteria" select the yellow star, and choose Select again (beneath "Simple value"). Choose here for the following options:

Fill in "System Resource" and "System OU Name" and select OK. In the next field choose Value (beneath "is equal to"). This will open a new window, with OU's recognized before (Active Directory System Group Discovery).

As you can see only 2 options are available. This because these are the only containers which contains systems. I choose "Virtual Machines" here, and select OK again. My Criterion properties has the following information now:

Choose OK multiple times now, and the configurating will be done. Now there is a new collection created, which is synchonizing from a Active Directory OU. When I choose Refresh, the systems in Active Directory will be automatically displayed in the "Virtual Machines" collection.

I hope you have enough information now for setting up a dynamic collection. When there are questions or other input, please add a comment to this blog, or contact me by e-mail.

Creating dynamic collections in ConfigMgr

When designing a new ConfigMgr environment, there is not only a total design needed but also a plan for the collections. I let my decision mostly be based on what functionality is needed, and if Active Directory is leading or not. This because you can create collections on many different ways, and advertisements can only be set on collections. So when you advertise an operating system, application or software update it will be bound to a collection. For OS deployment you can create additional colllections, but what to do with the other ones? The most used way is bound the collections to Active Directory OU's. In that way Active Directory is leading, and it will synchronize objects to ConfigMgr collections. I will explain here what to do, and how to bind them to Active Directory.

After installation of ConfigMgr there are a lot of default collections, but they are not always handy and useful. You can move this default collections to a new one, so there not in sight all the time. Now it's better to create your own collections, so you can decide which devices to put in your collections. There is a query needed for bounding collections to OU's, but first you must create these collections. You can do this manually, or there is also a way for importing them from Active Directory. The tool needed for that is named "SCCM OU Collection creator". This tool can be download here:

http://www.sccm-tools.com/tools/standalone/sccm-ou.rar.

With this tool you can create many collections at once, and the good news is it will be automatically bound to Active Directory OU's. Because you want to move these collections afterwards to another location, there is another tool needed, The tool needed for that is named "CollTree for SCCM". This tool can be download here:

http://myitforum.com/cs2/blogs/bleary/attachment/68439.ashx.

This tool is even compatible with SMS2003 collections, and it will become very handy. Okay, now the collections are imported, moved, and there is an query on it. But how to set a manually query on the collections? The command for that is not that difficult. First create a new collection, and open the properties of it. On the tab “Membership rules” create a new SQL query, and choose System Resource & Edit Query Statement, then select the Criteria tab. Choose New Query and fill in the following properties: 

Choose OK after that. Now you must decide how fast collections will be synchronized. Default the collection will be synchronized within 1 day. Because it can be to slow to have the objects in Active Directory synchronized with the collections, you can shorten the schedule to 1 hours, or even 15 minutes. Better is it to choose for the new R3 update, because collections will synchronized must faster then before. I will post that new functionality later. This is all you have to do for having dynamic collections in ConfigMgr.