This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi,
Something strange happened last night and I am trying to get to the bottom of it.
I have a Windows 10 In Place Upgrade collection - membership rule type is Direct
I have a remote site named HOP, which has a collection named "All HOP Computers". This collection has all workstation and servers, every device belonging to this site is in the collection.
IT personnel have been manually adding computers to the Windows 10 IPU collection for the win10 upgrade.
Last night, I had to redistribute the Win10 Upgrade package to HOP DP.
All of a sudden late in the night, ALL computers in HOP were getting the windows 10 upgrade.
While investigating what happened that triggered the mass upgrade, I found that somehow the All HOP Computers collection was added to the Windows 10 IPU membership as shown below.
Are there any ways I can find out how this collection made its way into the Win10 IPU collection?
Thank you so much!
Thank you for your responses. Yes, I did try to look at those status messages but all they showed was "User so and so modified the Collection Properties for a collection named "Windows 10 In-Place Upgrade" . This collection is currently assigned to the following ConfigMgr Administrators: "
That was all.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 28.999999999999996%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIE%3C/text%3E%3C/svg%3E)
You can ask related users about their actions. Probably they modified collection membership for any reason
Thank you. I have asked. I am the only sccm admin with full permissions. I have 2 other users with limited person. The rest of the IT Helpdesk team only has the Read Only permissions with the ability to modify collections so that they can add devices to the IPU collection.
This is one incident that has been puzzling me. Is it even possible that something in SCCM triggered it by itself? For a collection to be included in this IPU collection, one would have to physically open the IPU collection properties, click the Add Rule and select another collection, right?
CM itself will NOT add or remove devices from a collection. It will follow exactly what you have for query rules.
You can investigate status messages. They contain related information about collections: who created, modified and deleted.
Reffer the following article
The audit events should tell you.
We just had another incident and I am cracking my head trying to understand what is causing this.
I just created a new collection named "Exclaimer Cloud Agent" to push out the Exclaimer app. This collection includes the Windows 10 collection and excludes several other collections. A few hours later I was made aware that serveral windows 10 got the Windows 10 IPU upgrade. I went into the properties of the IPU collection and guess what? The Exclaimer collection was added to the IPU collection!!!!!!!!!
I really don't know what is going on!! If you say CM itself cannot add/remove devices, why this happened a 2nd time? Could it be that the inclusion/exclusion of the collections screwed this up? Because those windows 7 computers were upgraded to windows 10, they are now part of the Windows 10 collection. Could it be that because I included the Windows 10 collection in the Exclaimer collection that it automatically added itself into the IPU collection?
For any computers that were successfully upgraded to Windows 10, should I remove them from the IPU collection to hopefully avoid this in the future?