Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

SCCM 2012 - Global Conditions for AD Security Groups

Posted on 2013-06-20
1
Medium Priority
?
1,116 Views
Last Modified: 2013-09-05
Hello,
 
I have been trying to wrap my head around this problem. I am an SCCM 2007 administrator and we are porting over our packaged applications to SCCM 2012. Some of our packages have multiple programs attached to them. The programs attached to some of our packages define certain settings a group will get. For example "Package A" is used by 3 different business units and each has a certain configuration, so Program 1 will perform a slightly different configuration then program 2 or 3. Here inlays the problem, one of the major differences with the Application model in SCCM 2012 is that you can have multiple deployment types but they will be sequentially run at deployment time with whatever requirements are met.
One way I have been trying to get around this with little luck is create a scripted Global Condition that will pull back a list of all the groups a user is in.
 
$Raw = C:\Windows\system32\whoami /groups /fo csv /nh
$isgroup = $Raw |  %{$_.Split(",")[0] } | %{ $_ -replace ","""}
Return $isgroup
 
If run this in PowerShell it will return every single group a user is in from their current logged on system, each group is displayed on a new line. I have also tried to make them display all in one line  
$sg = $isgroup -join ' '
 Return $sg
 
Since I know each group will have an Active Directory Security Group that is unique to the business unit I can then add that requirement set the operator to "Contains" and the value to "Domain\ADGroup" in the Requirements tab in the deployment type.
 
When I go to deploy the application this explicitly fails out during the Requirements evaluation phase.
 
Has anyone been able to resolve this problem? Or is this a limitation of SCCM 2012?
 
I have seen examples online which basically run the whoami tool and compare it to a static group within the script. I do not want to create dozens of these Global Conditions. I would like to tackle this with one condition.
 
Any ideas would be appreciated.
0
Comment
Question by:osstesteast
1 Comment
 
LVL 19

Accepted Solution

by:
Mike T earned 2000 total points
ID: 39322465
Hi,

I think I can see what you're trying to do. If I recap with an example of what it sounds like you have setup.

Business units:
France
Germany
Spain

Apps
Visio

2007
Visio package
    Program: Install Visio /French.xml
    Program: Install Visio /German.xml
    Program: Install Visio /Spanish.xml

If so, have you tried just using a task-sequence instead. I had to deploy a package that someone in their wisdom in the past had split into 8 different MSIs and then installed them according to what OU and machine was used. It worked fine in AD but getting dependencies to work failed miserably.
My solution was to create a new task-sequence for each type of machine (6 max) and then control the targeting using the WMI conditions, with collections targeting the specific OUs.

The above Visio bundle would be a simple group with a condition on the outer group and then finer conditions on each sub-step.

There may well be a simpler way using deployments but I'd need to look at my lab machine and experiment. Task-sequences simplify it greatly.

If I've misunderstood please post a picture or three if you can :).

Mike
0

Featured Post

Ask an Anonymous Question!

Don't feel intimidated by what you don't know. Ask your question anonymously. It's easy! Learn more and upgrade.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The new Microsoft OS looks great, is easier than ever to upgrade to, it is even free.  So what's the catch?  If you don't change the privacy settings, Microsoft will, in accordance with the (EULA) you clicked okay to without reading, collect all the…
Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question