Share via

Speed up SCCM / ConfigMgr deployment based on AD User Security Group?

Courtney Regan 71 Reputation points
2023-12-18T14:12:56.8733333+00:00

Hello. I have a deployment assigned to me that will reference an AD Security group. We did this a few months ago and the time it took was brutal for all to get the software. It took almost 6 weeks to finish. I checked discovery method settings for AD User Discovery and it's set to every 6 hours. In the client policy, it's set to check every 30 minutes. Can you guys think of things to check to speed this up?

I wanted to do a direct user add collection for this new deployment, but I was overruled for a variety of reasons.

Microsoft Configuration Manager Deployment
Microsoft Configuration Manager Deployment
Microsoft Configuration Manager: An integrated solution for for managing large groups of personal computers and servers.Deployment: The process of delivering, assembling, and maintaining a particular version of a software system at a site.
939 questions
Microsoft Configuration Manager Application
Microsoft Configuration Manager Application
Microsoft Configuration Manager: An integrated solution for for managing large groups of personal computers and servers.Application: A computer program designed to carry out a specific task other than one relating to the operation of the computer itself, typically to be used by end users.
472 questions
Microsoft Configuration Manager
0 comments
Accepted answer
  1. Sherry Kissinger 4,136 Reputation points
    2023-12-18T20:35:30.7266667+00:00

    There is a slight difference in a user collection, where the collection contains the resourceIDs of the users, that happen to be in a usergroup. That type of collection query requires multiple timings: 1) the user being added to the group, 2) the group discovery occuring (not user discover, group discovery), and 3) the collection update/refresh. Depending upon timing, that can take a while.

    The other type of user collection where the defining factor is the usergroup, is where the collection contains one and only one resourceid: the resourceid of the Usergroup. That's the kind I prefer. That way, the group really only needs to be discovered once, initially (and re-discovered on a schedule), but you don't need to wait for group discovery for "new users added".

    When you make the User Collection, make sure you select "user group resource" as the resource class, and the collection query is similar to... where SMS_R_UserGroup.UsergroupName = "That Group Name". When the collection updates, there should be only one entry in the collection--even if in AD there are hundreds of users.

    The beauty of this type of collection is that CM knows the token sids associated with usergroups that the user belongs to; and upon user policy refresh, it'll deserve policies deployed to this usergroup. So, in the end, let's say Mary Smith is added to "Widgets_3.0" group. Mary Smith simply needs to lock and unlock her console following that group membership add in AD, and CM will know about it, and immediately deserve the policy.

    If you do it the other way (the collection ends up containing the resourceid for 'Mary Smith'), that means group discovery, collection update, and then finally policy refresh.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Garth Jones 1,656 Reputation points
    2023-12-18T15:32:53.5633333+00:00

    How exactly have you setup your Collection for this deploymnet? What do you mean it is take 6 weeks to complete?