Solved

SCCM 2012 - Global Conditions for AD Security Groups

Posted on 2013-06-20
1
1,023 Views
Last Modified: 2013-09-05
Hello,
 
I have been trying to wrap my head around this problem. I am an SCCM 2007 administrator and we are porting over our packaged applications to SCCM 2012. Some of our packages have multiple programs attached to them. The programs attached to some of our packages define certain settings a group will get. For example "Package A" is used by 3 different business units and each has a certain configuration, so Program 1 will perform a slightly different configuration then program 2 or 3. Here inlays the problem, one of the major differences with the Application model in SCCM 2012 is that you can have multiple deployment types but they will be sequentially run at deployment time with whatever requirements are met.
One way I have been trying to get around this with little luck is create a scripted Global Condition that will pull back a list of all the groups a user is in.
 
$Raw = C:\Windows\system32\whoami /groups /fo csv /nh
$isgroup = $Raw |  %{$_.Split(",")[0] } | %{ $_ -replace ","""}
Return $isgroup
 
If run this in PowerShell it will return every single group a user is in from their current logged on system, each group is displayed on a new line. I have also tried to make them display all in one line  
$sg = $isgroup -join ' '
 Return $sg
 
Since I know each group will have an Active Directory Security Group that is unique to the business unit I can then add that requirement set the operator to "Contains" and the value to "Domain\ADGroup" in the Requirements tab in the deployment type.
 
When I go to deploy the application this explicitly fails out during the Requirements evaluation phase.
 
Has anyone been able to resolve this problem? Or is this a limitation of SCCM 2012?
 
I have seen examples online which basically run the whoami tool and compare it to a static group within the script. I do not want to create dozens of these Global Conditions. I would like to tackle this with one condition.
 
Any ideas would be appreciated.
0
Comment
Question by:osstesteast
1 Comment
 
LVL 16

Accepted Solution

by:
Mike T earned 500 total points
Comment Utility
Hi,

I think I can see what you're trying to do. If I recap with an example of what it sounds like you have setup.

Business units:
France
Germany
Spain

Apps
Visio

2007
Visio package
    Program: Install Visio /French.xml
    Program: Install Visio /German.xml
    Program: Install Visio /Spanish.xml

If so, have you tried just using a task-sequence instead. I had to deploy a package that someone in their wisdom in the past had split into 8 different MSIs and then installed them according to what OU and machine was used. It worked fine in AD but getting dependencies to work failed miserably.
My solution was to create a new task-sequence for each type of machine (6 max) and then control the targeting using the WMI conditions, with collections targeting the specific OUs.

The above Visio bundle would be a simple group with a condition on the outer group and then finer conditions on each sub-step.

There may well be a simpler way using deployments but I'd need to look at my lab machine and experiment. Task-sequences simplify it greatly.

If I've misunderstood please post a picture or three if you can :).

Mike
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Many companies are making the switch from Microsoft to Google Apps (https://www.google.com/work/apps/business/). Use this article to learn more about what Google Apps has to offer and to help if you’re planning on migrating to Google Apps. It is …
Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now