ADR Removes updates from existing Software Update Group

I'm working on using SCCM for Software Updates, was previously only using WSUS. I think I've got everything configured and I can deploy updates successfully. So now I'm working on automating things with some ADRs. The problem I'm running into is that I'm
trying to set the ADR to add updates to an existing group. Office 2007 updates in this example. I have the search criteria in the ADR set to look for Office 2007 updates released in the last 30 days and it is set to run once a month.
So in my mind, each month it will run and add the necessary updates to the existing group, and the group will become a cumulative list. The problem I'm having is that every time the rule runs, it seems to remove all the existing updates from that
group and only add in the updates that were returned for that run. For example, I can set the rule to search for updates released in the last 60 days and will see 15 updates in the group. If I change the rule to search for updates released in the
last 30 days and run it again, the group will only have 10 updates in it. Or if I manually add updates to the group and then run the rule again, the updates I manually added are removed. None of these are expired or superseded. Any ideas?

The spirit of the statement is more or less correct, but as it applies to this scenario it is not. To the clients, nothing has changed. The update is part of the update group before and after. Thus, the client only knows about the newly added updates thus
there really is no client side processing churn except for the newly added updates. As for the SQL processing, that's what SQL does well -- that's the whole point of using a enterprise class RDBMS. Tip-toeing around SQL, particularly for a process that only
happens once a month, is (sorry) silly. Now, if you were to do this everyday, then yes, that's bad. Once a month, it's trivial. Do of course make sure you have a good SQL maintenance plan in place that includes re-indexing and rebuilding statistics (not the
built-in maintenance task).
Jason | http://blog.configmgrftw.com | @jasonsandys

Similar Messages

Removing DRM from existing purchases

Hi all,
I love iTunes, but could never stand the DRM that came bundled with purchases. Now DRM's been removed from music I'm loving it again. I've made half a dozen purchases already today and I'm delighted with how easily my existing MP3 software was able to convert the M4A files to MP3.
One question though, is there a way within iTunes to either re-download past purchases, or to remove DRM from purchases made before Apple stopped including DRM with music?
Thanks.
Lex.

Access the iTunes plus upgrade screen from either the right hand top in the store in the upper box or by clicking on the iTunes plus advert in the middle of the store screen near the free download screen.
If you have none of these links it may mean that none of your past purchases is currently available. The entire store will not be DRM free until near April, currently only close to 8 Million tracks are available, though I think new are still be added daily.

How to Remove User from Built in Administrators group With Group Policy Enabled

Hi,
I want to remove user from Administrator group which is in restricted group. So I cannot remove him through Active Directory what is the way to remove user from Administrator restricted group.
Thanks
Jibran Ishtiaq

> Disable Group policy
"Edit", not "Disable"
> Under Domain click Delegation and went to the restricted group account.
> Remove User from group.
Why "Delegation"? Simply edit the GP object where the "Restricted
Groups" setting is in place...
> Also we have two DNS but one from where I remove account is the primary.
How is DNS related to group policy?
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Who removed user from AD Universal secuirty group

Hello , i am trying to find who removed user from universal AD group , i checked audit management policy is enabled but some how event is not getting generated or unable to find those events so please help how to find who did that job - removed the user
from universal security group.
And suppose if anybody is deleting and the logs should be generated on one of the local site Domain controller is that correct ? so anywhere or it can be generated on the member server. Any free third party tool who can help here .
Thanks

Here is another informative technet blog resource that helps to track all the changes made in active directory : http://blogs.technet.com/b/askpfeplat/archive/2012/03/05/how-to-track-the-who-what-when-and-where-of-active-directory-attribute-changes-part-i-the-case-of-the-mysteriously-modified-upn.aspx
If you wish to audit such changes automatically, you may also consider on this automated solution (http://www.activedirectoryaudit.com/) that would be a better approach to audit all the critical changes
into real time and get instant notification for through customized email notification.

Remove users from Sharepoint site security group

I have to close a share point 2007 site for all users for an update. I don't have access to CA. the easiest approach is to remove the users from security group and add them back when the site modification is done. All users all under "NT/Aunthenticated
users" and they are in Members group. I'm just wondering will it cause any issues when adding them back or it can be done in 1 click. Do i need any tweaks from CA side to add them back?
Any response is appreciated.
Thanks!

Once you add the users back to the site, it should work as expected.
>>Do i need any tweaks from CA side to add them back?
No i believe, because you are changing the permissions at site level.
My Blog- http://www.sharepoint-journey.com|
If a post answers your question, please click Mark As Answer on that post and Vote as Helpful

I need help removing hosts from all Active Directory Groups! - PowerShell

In our environment, we use AD Groups to create collections in Configuration Manager. I have a few PC's that need to be removed from all AD Groups in our Forest. I do not know how many groups these computers are in and to script it in PowerShell. Could
someone please guide me in the right direction?

Hi,
Here's how you can check group membership:
Get-ADComputer COMPUTERNAME -Properties MemberOf |
Select -ExpandProperty MemberOf
http://ss64.com/ps/ad.html
Don't retire TechNet! -
(Don't give up yet - 13,085+ strong and growing)

Software update group - Superseded updates

Hi all,
I need to understand something. I have Software Update Group and it has a deployment configured . When a given update becomes superseded and I remove it from the software update group, how does this affect the configured deployment? I don't
want to delete/recreate the deployment. Will the deployment automatically update itself and remove the update that I removed from the Update Group, will it still try to deploy the upddate...wil it give an error...etc.
Thanks in advance,
Jesmat.

The deployment is for the updates in the software update group. For currently targeted devices it will need a machine policy update before they know about the change.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Remove user from multiple groups

Hello everyone, first time posting here with a question and I apologize if I'm asking in the wrong location.
To give an idea of what I'm attempting to do, I've recently been developing a vbscript that will take a nightly csv export from my student information system and either create or deactivate student accounts based upon their enrollment status. I have
this function working great now, another function I've been developing is to have accounts moved between OU's based upon the school building code assigned to students which I have working as well. The problem I'm running into right now is having students
removed from existing active directory groups when they move between OU's. Essentially what I would like to do is have the script load the users group membership into an array and then remove any groups that end with STUDENTS, below is the code I have
been working on to accomplish this but have literally hit a brick wall. If it helps all my student groups for each location runs in this fashion.
ABCD_STUDENTS
ABCE_STUDENTS
Any suggestions would be greatly appreciated.
' Student changing OU then we need to update their account to reflect appropriate group memberships.
Set UserObj = GetObject("WinNT://server.domain.net/" & ADusrname) 'This must be hardcoded to domain controller
strUserDN = DN
strUserCN = objuser.cn
'Add user to the school group if not correct
Set objGroup = GetObject(varSchoolGroup)
strUserDN = DN ' Bind to the user object.
strGroupDN = varSchoolGroup ' Specify group Distinguished Name and check for membership.
Set objADObject = GetObject("LDAP://"& strUserDN)
objmemberOf = objadobject.GetEx("memberOf")
If Not (funIsMember (GetObject("LDAP://" & strUserDN),varSchoolGroup)) Then
objmemberOf = objadobject.GetEx("memberOf")
For Each objGroup in objmemberOf
Set objGroupDelete = GetObject ("LDAP://" & objGroup)
If Mid(objgroup,7,8) = "STUDENTS" Then
msgbox "test remove"
objGroupDelete.PutEx ADS_PROPERTY_DELETE,"member",Array(strUserDN)
objGroupDelete.setinfo
subUpdateLogFile studentcounter & " - Removed from student group " & objgroup,student_guid,student_username,student_fullname,"removed group"
End If
Next
'Add user to school group
Set objGroup = GetObject(varSchoolGroup)
objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array(struserdn)
objGroup.SetInfo
subUpdateLogFile studentcounter & " - Updated school group to " & student_schoolgroup_ldap,student_guid,student_username,student_fullname,"school group"
objUser.SetInfo
updated = "yes"
End If
Any suggestions would be greatly appreciated.

With Bill. This can be done with AD and PowerShell in a couple of lines for reach item.
You are taking an incorrect approach which is making this much harder than it needs to be. Your question is also hard to understand.
Each AD usre object obtained via ADSI will have a list of groups the account is a member of. You use this to remove the user from the group. How you choose this is up to you. You can use an array or a file. You can also =just use
OU associated groups. A user then is added to all or some groups associated with the OU and removed from the groups associated with the OU by just returning the OU associated group list from the OUs.
Designing AD systems is a specialty. Once you fully understand the features and capabilities of AD these things are usually simple and painless. If the design is not done well they are painful and faulty.
We can answer specific questions. Understaning the design and capabilities of AD is mostly up to you.
Start with a tool that is designed to work well with AD like PowerShell. VBScritp is onluy useful to those who are skilled with AD and scripting in VBSdcript. From your script we can see you are a beginner at both. As Bill notes...do yourself
a favor and switch to PowerShell.
¯\_(ツ)_/¯

Cisco Prime 2.1, Removing Subgroup from Group in the Device Work Centre

Hi All,
I am having trouble removing a Device Group from within a Group in Cisco Prime.
In short, there is a group called 'Cisco 3850 Series Ethernet Stackable Switch' which exists under both the 'Wireless Controller' group and the 'Switches and Hubs' group. I want to remove it from the 'Wireless Controllers' group as we are not using the controller functionality of the deivce.
Can anyone help on this issue?
Thanks,
Cameron

Hi TD,
I would suggest you to take both the backup ::
Application and appliance backups
Prime Infrastructure creates two types of backups:
Application backups: These contain all Prime Infrastructure application data, but do not include host-specific settings, such as the server hostname and IP address.
Appliance backups: These contain all application data and host-specific settings, including the hostname, IP address, subnet mask, and default gateway.
Note that:
Application and appliance backups can be taken from both virtual and hardware appliances.
Either type of backup can be restored to the same or a new host, as long as the new host has the same hardware and software configuration as the host from which the backup was taken.
You can only restore an application or appliance backup to a host running the same version of the Prime Infrastructure server software as the server from which the backup was taken.
You cannot restore an application backup using the appliance restore command, nor can you restore an appliance backup using the application backup command.
refer the below links::
http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-2/administrator/guide/PIAdminBook/backup_restore.html#10347
http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-2/administrator/guide/PIAdminBook/backup_restore.html#72460
Thanks-
Afroz
***Ratings Encourages Contributors ****

Removed user from group, user no longer has access to documents even though user is owner of documents

I'm running a server 2012 std domain and I'm in the process of rebuilding our fileserver after we had some pretty serious permission issues. Bad permissions (Everyone had full access to user documents share) were migrated when we move to the new server and
then by some strange Monday morning freak out all users lost access to their documents. I restored from backups, redirected everyone's folders back to local computer and started to reconfigure the share permissions. I moved our administration group back to
the server after securing proper permissions for folder redirection (permissions copied from https://technet.microsoft.com/en-us/library/jj649078.aspx?f=255&MSPPError=-2147217396 table 1, only difference is instead of creating a new security group
for redirection users, I used the everyone group) to test and everything went perfectly. The GPO created the users folders under the root and redirection was good to go. Along with that, other users cannot access other users documents anymore which was the
intended outcome.
Last night I was looking at security groups and see that our administration group (back office group: accounting, HR, etc..) was a member of the domain admins. I removed them from the domain admins group and added them to the administrators group (they do
need regular admin access) then went on like normal. This morning, all users in that group can no longer access their documents on the server. I immediately think that permissions were broken again and started to get angry, but then realize that all the files
are still accessible on the server (no lost permissions like before) and the user is still shown as the owner with full permissions, but the files are inaccessible to those users. I re-added them to the domain admins group, logged out, logged back in and documents
are back and accessible by the user. Remove them from the domain admins group, log out, log back in and the documents are inaccessible again. Re-add to the domain admins group and back to normal.
Which leads me to now. If the users are part of the domain admins group, they have access to their files. If they are removed from the domain admins group, they lose access. When they lose access, they are still the owners of the files/folders with full
permissions, yet they can't access their documents. Also, just to add, the domain admins group has no specified permissions on the files or folders. See screenshots below..
Here is the root share.
And the user's desktop folder. The folder is owned by the user with full permissions. This is the folder the redirection GPO created.
Any ideas why removing the group from domain admins would drop access to their files? They are still the owners of the files and should have full access but they don't. Is there something I'm not seeing here?

Effective Access shows the user has full control of the Desktop folder
This is a problem with the Effective Access tab when using CREATOR OWNER. As you have noticed, the user doesn't really have the access that the tab says it does. This is because of how CREATOR OWNER works.
CREATOR OWNER is only evaluated when a file/folder is created.
IF a user can create a file/folder, then the permissions assigned to CREATOR OWNER are copied to a new permissions entry for that user.
To see this:
Logon as an administrator and create a file in the Desktop folder in your screenshot.
Examine the permissions of the new file.
You'll see that there is a new entry for the account you logged on with.
CREATOR OWNER is gone. CREATOR OWNER would still be there if you created a folder (because of "subfolders and files").
In the Desktop folder (in your screenshot), only SYSTEM and Administrator can create/access files.
To fix this, you need to grant the users the ability to list the directory contents and create new files/folders. This corresponds with the suggestion of Table 1 in the document you found.
I see what you're saying about Administrators domain group. I'll just add them as local admins via GPO and that should solve that issue.
No, scary! This will grant those users administrative permission on your server. They will be able to see any file anywhere on that server.
If your goal is to provide a place that is private for each user, then the simplest approach is to grant each user permission to their own folder. Like this for Test User:
Notes for above:
I set the user's permission to Modify because there is no good reason why the user should change these permissions
The owner of this folder is unimportant. I leave it set to Administrators
You can, and I do, remove CREATOR OWNER. It adds no value in this situation and just causes confusion.
As for the second screen shot, the *-Admins folder is the root to which Everyone has special permissions on and can create folders. The folder for M* was created by the GPO, which makes M* the owner to which they have Full control of subfolders and files.
The GPO also created the Desktop folder, giving owner full permissions of subfolders and files. Inside the Desktop folder, permissions remain Full control for owner for subfolders and files. Even if it was the case that they only had permissions on subfolders
and files, wouldn't each subfolder under that one be considered a subfolder and file of the top folder?
If this works as you say, then Yes, it should work. But, I don't see the entries for use M*. Remember, there should be entries for the M* user that is a duplicate of CREATOR OWNER.
I suspect that Group Policy is creating the directories (elevated) and then changing the owner to M* afterward. This does not duplicate the CREATOR OWNER entries as needed. If this is the case, I consider it a flaw because your permissions do
not allow user M* to create files/folders, and group policy shouldn't bypass security.
I'm not saying your wrong, I'm just curious why the technet article would advise Creator/Owner giving full control of subfolders and files only if that were not correct. I can add the permissions for the users easily, I just don't see why I need to give
explicit permissions to access something when the GPO created those folders for me, which Microsoft recommends you allow. If the GPO can create folders and the folders are owned by the user, then the user can obviously add/create/modify/view those files and
folders.
When I restored the data, no permission were reset. Permissions were restored to the wonky version where the Everyone group has full access to everything. Ownership of the files/folders remained the same.
A couple things:
The article instructed the use of Folder Redirection Users group that had permissions to create files. Your examples didn't have that. Because of this, your user could create new files.
The article assumes that the directories you are creating will be empty. Existing files will be unreadable to everyone except Admins.
If you follow the directions in the article, then anyone in the Folder Redirection Users group can write files to anyone else's directory.
One benefit of the document's approach is that all the users could be redirected to the same folder using the article, and it would work. A benefit, I guess.
But, I like my user's separate and unable to see each other's files -- at all. This is why I recommend replacing CREATOR OWNER with the specific user.
I believe this document is a "how to get it done" document, not necessarily a best practices document. I see it as a starting point, and that's why I didn't follow it exactly.
Lastly, CREATOR OWNER permissions are useful but confusing. I avoid them unless I have the rare circumstance where they are perfect.
When I restored the data, no permission were reset. Permissions were restored to the wonky version where the Everyone group has full access to everything. Ownership of the files/folders remained the same.
To summarize:
In the user's directory, you need to provide permission to list and create new files/folders, and you need grant the user permission to the existing files.
-Tony

Deleting Profit Centres and removing them from Profit Centre Groups

Hi,
I have recently deleted some 3000+ unused profit centres from our system. However the problem I'm having is that these existed in a number of profit centre groups and the values are still
displaying with the text "no valid master record".
Is there a quick way to remove these from the profit centre groups as I don't relish the prospect of removing them all manually. The standard hierarchy is not a problem they have autoatically been removed from there.
thanks in advance.
Paul.

Hi,
The deletion of the profit centres has been completed and wasn't a problem.
It's the removal of the values of these profit centres from various profit centre groups that is causing a problem. They still appear in the groups even though the underlying master data no longer exists.
Paul.

My wife's Apple ID is shown as belonging to a family sharing group, but we can't determine what is the id of the owner. How can she remove herself from the group?

my wife's apple ID is shown as belonging to another family sharing group. We can' t figure out the Apple ID of the 'owner' of the group. Is there any way to remove oneself from a family sharing group when you are not the owner? Or how can we find the log in id (Apple ID) of the owner?

i partially solved the problem, however still need some help. My wife has made purchases under two different Apple ids. I tried t re-set her iPad with her main ID but it is apparently part of a family. I re-set her iPad iCloud using her secondary ID. The sharing of iTunes shows her main apple ID. The settings iTunes is also set to her main Apple id. I sent an invite from her iPad icloud family sharing to her main Apple ID, but when I attempted to consent to join it says she is already a member. So I am guessing this is because in the family set up under her secondary ID that her main id is the iTunes account that is shared. My question is could I change the iTunes shared under her name as owner to her secondary account, then invite her main account to join as a distinct member? I am nervous about doing this for two reasons 1. There is a warning when changing the shared iTunes account that says you can't join another group for 90 days. 2. I may still get the message that her main account is still a member of the group even though it doesn't show up, and then not able to revert back.
if you follow this can someone offer some help,
thanks
note. This whole problem when we had to change a Apple id when we changed Internet service providers.

If I can remove built-in account from built-in Administrators Group?

Backgroud:
       Someone created a win2003 AD environment, and I upgraded it to win2008r2 AD recently.There is a bulit-in administrator account named domainsvrusr. Unfortunately, the account revealed to some users. Due to security
reason, I want to recover the permission and just let the domainsvrusr account have a domain user permission. And I also need to keep the account have a local-admin permission.
Plan:
        I added domainsvrusr to local administrators group on every servers(For 2008, use the GPO; For 2003, manually added). I want to achieve this goal by removing it from the Built-Admin group. However, I find
it is impossible due to this account is a built-in account.
Question:
        1、If there is any possiblity to achieve this goal by just removed the account out of the group? ( I find some info that says it will not be possible... really?)
        2、The client-server must use the domainsvrusr account. I also consider to rename the default domainsvrusr acoout, and then create a new one. But I think the client-server will also point to the renamed account.
I think it will not be useful... Are there any other alternatives can achieve this goal?
          Thanks all !

I agree with Mahdi. You can't delete a built-in account. Just rename it and change the password.
If you need to use that same account name, after you rename the built-in account and change the password, create a regular domain user account for local admins, and follow what Mahdi suggested to use Restricted Groups.
* If you want more info on how to use Restricted Groups, read the discussion in the following link:
Good discussion about Restricted Groups with a complete step by step:
Technet thread: "AD Question, Group as Administrator?" 3/13/2012 - Read the step by step I posted:
http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/880ad98a-f6bd-4132-ac8b-441d721e2762/
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

Remove buddy from group

Hi,
I've got iChat 3.1.9 and have an issue where my buddies are showing up in multiple groups. So they are showing up in my Family group as well as my Buddies group and I can't figure out how to remove them from one of the groups without removing them from iChat entirely. Is there an easy way to fix this? Maybe a setting in Address Book or something I'm missing? Thanks so much.
-NifflerX

Hi,
Drag them from the group they appear in to the Group you want them to be in (even if already there)
You probably used a Modifier key (Shift or the Apple Key) to Move + duplicate the Buddy in different groups before.
7:49 PM Sunday; October 11, 2009
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

Update showing up in "Compliance 5 - Specific Computer" Report even after removing the update from the Software Update before creating Group and Package

So I've created a Software Update Group and I did NOT want anything in there dealing with Internet Explorer 11 since the organization is currently stuck at using 10 as the highest. So I made sure that Internet Explorer was NOT in the list and then I deployed
the package.
After running my Overall Compliance report it shows that the systems are compliant, but when I view the "Compliance 5 - Specific Computer" I see that "Internet Explorer 11 for Windows 7 for x64-based Systems" is listed in the report.
This is just a testing phase right now and I have not created a WSUS like Domain level GPO. I understand that the SCCM client creates a local policy on the clients for the location of the Software Update Point (Specify
Intranet Microsoft update service location), but the "Configure Automatic Updates" policy is set to Not Configured, which it looks like when this
is set, the "Install updates automatically (recommended)" at 3AM is the default.
Is the reason why the "Internet Explorer 11 for Windows 7 for x64-based Systems" update is showing up in the list due to the fact that the "Configure
Automatic Updates" policy is set to Not Configured
and therefore it is still reaching out to check Windows Update online?
So, if I do create a Domain level GPO to Disable the "Configure
Automatic Updates" policy, then the "Internet Explorer 11 for Windows 7 for x64-based Systems" update would not show up in the "Compliance 5 - Specific Computer" report?
By the way, I have a Software Update Maintenance Window configured for the hours of 1AM-4AM so the 3AM default time falls within this time frame, therefore, I am assuming the SCCM 2012 client will not allow the Windows Update Agent to install the "Internet
Explorer 11 for Windows 7 for x64-based Systems" update, even though it has detected it is "Required".
Thanks

But, don't you need a Deployment Package in order to deploy the Software Update Group? The Software Update Group uses the downloaded updates contained in the Deployment Package located in, wherever the Package Source is, right?
One more quick question that you will know right off hand, because, well, you just will I'm sure.
No. The software update group really has nothing to do with any update packages. The update group assigns updates to clients and in turn clients use update packages to download assign and applicable updates from. There is no connection between the two though
as the client can download an update from any available update package. Thus, it's more than possible to updates in an update package that are not in any update groups and it is also possible for an update to be in an update group without being in any update
package.
If the "Configure Automatic Updates" policy is set to "Not Configured" and since this keeps the 3AM Automatic Updates default, if I was to remove the Software Update Maintenance Window from being between 1AM-4AM, will the WUA agent install updates
at 3AM, or no because the SCCM 2012 client still manages and oversees it and basically blocks that from occurring?
No, ConfigMgr does not in any way block the WUA; however, the WUA can only autonomously install updates it downloads directly from WSUS. Thus, since there are no updates approved or downloaded in your WSUS instance, there's nothing for it to download and
install. If you happen to actually be going into WSUS and approving updates (which you should not be doing as its unsupported), then yes, it actually would install updates -- this is outside of ConfigMgr's control though. Generally, disabling the WUA via a
GPO is the recommended to prevent any accidental installations or reboots (as the WUA wil also check for initiate pending reboots outside of ConfigMgr).
Lots more info in these two blog posts:
- http://blog.configmgrftw.com/software-update-management-and-group-policy-for-configmgr-what-else/
- http://blog.configmgrftw.com/software-updates-management-and-group-policy-for-configmgr-cont/
Jason | http://blog.configmgrftw.com

ADR Removes updates from existing Software Update Group

Similar Messages

Maybe you are looking for