How to Distribute Software Using AD Groups
Updated: 31 Jul 2008 | 6 comments
In the latest user group meeting, many have asked how a target collection can be created using AD groups for software delivery or other actions. I have found a KB article that tells you how to use SQL criteria to take AD Groups (With Users) and turn them into machine collections for NS policies.
Here is the article for reference: https://kb.altiris.com/article.asp?article=39250&p=1. It is KB article number 39250.
I hope this helps!
Patrick
blog entry Filed Under:
Group Ownership:
About Endpoint Management Community Blog
The Endpoint Management Community Blog is the perfect place to share short, timely insights including product tips, news and other information relevant to the Endpoint Management community. Any authenticated Connect member can contribute to this blog. Filter by:
Blog Tags
Configuring Altiris Client Management Suite Altiris Deployment Solution Symantec Management Platform (Notification Server) Wise Packaging Basics Altiris Server Management Suite Best Practice Compatibility Tip/How to Helpdesk Solution Altiris IT Asset Management Installing Workflow Solution Ghost Solution Suite Windows Reporting Performance Upgrade Features ServiceDesk 7.x Database Agents Dell Management Products
Comments
This works great
We have been using this method to deploy software for a while now.
The only downside is that sometimes users may use more than one computer or users may share a computer so if software licensing is an issue you may want to be careful with this one.
It really does save a lot of time though and makes it so that you never have to modify the collection once it is created.
No Security Groups in Resource Management
Do you do anything special to import your security groups from AD? Looking under Resource Management>Collections>Directory Collections>My Domain I have three folders:
Organizational Units
Organizational Units - Users to Machines
Sites
I can not find where Security Groups - Users to Machines is and am wondering if I am not importing them in our Active Directory import.
Any advice would be appreciated as I would like to take advantage of this for our company. Thanks.
You need to create a new AD Import rule
Hi theMike,
You need to add an additional AD Import rule. When you define the rule, you want to import User resources from a Source of "Security Groups". Check both boxes for "Create security group collections" and "Match computers with primary users". Define your domain in the first part of the import config, then in the "starting from" part, you can add the groups you want to import.
Thanks,
Kyle
Symantec Trusted Advisor
For Forum threads, please click "Mark as Solution" if answered.
For all content, please give a thumbs up if you agree with or support the post.
security import
Hi Kyle,
I saw your comment in the post and thought you would be the perfect person to ask.
I have a requirement to report on all user accounts and security groups in AD.
I would like to see security info from users and accounts eg. user A has ADMINISTRATOR rights or user A is in the ADMINISTRATORS security group.
Will i be able to get this info out of the import; I tried but no cigar.
Built-in report
toca,
There is a build in report "Count of users with Admin rights" (or something similar to that) in the Inventory reports. It will allow you (I believe) to dump the membership of all computers' Administrators groups. This will not however dump all the group memberships of AD groups, unless you import those groups from AD as far as I know.
Thanks,
Kyle
Symantec Trusted Advisor
For Forum threads, please click "Mark as Solution" if answered.
For all content, please give a thumbs up if you agree with or support the post.
Not using primary user
We found the primary user option to be hit or miss. For this reason we're using the asset owner information to assign software to the machine. See below for the sql query. The first query builds the collection for us based upon the user associate. The second query (after the union) allows us to add the computers that were assigned to the group. This enables us to assign a computer to the AD group which works well for computers that are shared or for users that have more then one computer and the software license cost is too expensive software to install on more then one of their computers.
Would you like to reply?
Login or Register to post your comment.