How to configure SCCM 2012 discover user group only?

Hi,
I'm wondering if there is a way to discover user group only (ignore computer group) in SCCM 2012?
Jason

Hi,
Also note that by default, only security groups are discovered. However, you can discover the membership of distribution
groups when you select the checkbox for the option Discover the membership of distribution groups on
the Option tab
in the Active Directory Group Discovery Properties dialog box.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

SCCM 2012: create user/group which can only import computers, reset pxe boots

Hi,
We would like to give helpdesk some basic rights so they can add computers (via mac/pc name) and reset pxe-boots.
We might grant extra rights but would like to start with these basic ones.
I know the setup is fully different (RBAC) so your feedback how you implemented this would be highy appreciated.
J.
Jan Hoedt

You can use "Custom Role Based Administration for Importing Computers" (http://blogs.technet.com/b/inside_osd/archive/2012/04/30/custom-role-based-administration-for-importing-computers.aspx)
as a starting point. Then use "RBA Viewer" (part of the toolkit) to create your own, custom roles.
Torsten Meringer | http://www.mssccmfaq.de

Identity Server has not been configured for this new user/group suffix

Hi all
I am having a problem trying to configure the Directory Server (5.2) for Messaging Server.
My configuration is as follows:
SJES Q12005
Server 1 - Directory Server 5.2
Server 1 - Access Manager (formerly Identity Server)
Server 1 - Web Server 6.1
I have successfully installed the above and can login to Access Manager.
I next installed Calendar & Messengar Server on "Server 1". Upon running "comm_dssetup.pl" from /opt/SUNWcomds/sbin, I get the following error:
"Identity Server has not been configured for this new user/group suffix"
Copy and paste of what I entered:
bash-2.05# perl comm_dssetup.pl
Welcome to the Directory Server preparation tool for
Sun Java(tm) System communication services.
(Version 6.3 Revision 1.0)
This tool prepares your directory server for use by the
communications services which include Messaging, Calendar and their components.
The logfile is /var/tmp/dssetup_20050830165940.log.
Do you want to continue [y]:
Please enter the full path to the directory where the Sun ONE
Directory Server was installed.
Directory server root [var/opt/mps/serverroot] : /opt/mps/serverroot
Please select a directory server instance from the following list:
[1] slapd-sunldap
Which instance do you want [1]:
Please enter the directory manager DN [cn=Directory Manager]: cn=DirMan
Password:
Detected DS version 5.2
Will this directory server be used for users/groups [Yes]:
Please enter the Users/Groups base suffix [dc=samplecompany-dev,dc=co,dc=uk] : ou=infrastructure,o=sampletown,dc=samplecompany-dev,dc=co,dc=uk
There are 3 possible schema types:
1 - schema 1 for systems with iMS 5.x data
1.5 - schema 2 compatibility for systems with iMS 5.x data
that has been converted with commdirmig
2 - schema 2 native for systems using Identity Server
Please enter the Schema Type (1, 1.5, 2) [1]: 2
Identity Server has not been configured for this new user/group suffix
You can opt to continue, but you will not be able to use
features that depend on Identity Server
Are you sure you want this schema type? [n]:
I have entered my user group suffix exactly as specified during the Access Manager install (hence I am able to login as "amadmin").
Looking at the LDAP logs to try and figure out whats going wrong I see its not getting hits on all searches it is performing:
[30/Aug/2005:16:41:18 +0100] conn=299 op=159 msgId=161 - SRCH base="ou=services,ou=infrastructure,o=northampton,dc=dataforce-
dev,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(objectClass=*)(objectClass=ldapsubentry)))(obj
ectClass=referral)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=netscapeServer)(objectClass=netscape
Resource)(objectClass=domain))" attrs="dn"
[30/Aug/2005:16:41:18 +0100] conn=299 op=159 msgId=161 - RESULT err=4 tag=101 nentries=1 etime=0
[30/Aug/2005:16:41:18 +0100] conn=299 op=160 msgId=162 - ABANDON targetop=NOTFOUND msgid=161
[30/Aug/2005:16:41:18 +0100] conn=299 op=161 msgId=163 - SRCH base="ou=people,ou=infrastructure,o=northampton,dc=dataforce-de
v,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(objectClass=*)(objectClass=ldapsubentry)))(objec
tClass=referral)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=netscapeServer)(objectClass=netscapeRe
source)(objectClass=domain))" attrs="dn"
[30/Aug/2005:16:41:18 +0100] conn=299 op=161 msgId=163 - RESULT err=0 tag=101 nentries=0 etime=0
[30/Aug/2005:16:41:18 +0100] conn=299 op=162 msgId=164 - SRCH base="ou=clientdata,ou=infrastructure,o=northampton,dc=dataforc
e-dev,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(objectClass=*)(objectClass=ldapsubentry)))(o
bjectClass=referral)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=netscapeServer)(objectClass=netsca
peResource)(objectClass=domain))" attrs="dn"
[30/Aug/2005:16:41:18 +0100] conn=299 op=162 msgId=164 - RESULT err=0 tag=101 nentries=1 etime=0
[30/Aug/2005:16:41:18 +0100] conn=299 op=163 msgId=165 - ABANDON targetop=NOTFOUND msgid=164
[30/Aug/2005:16:41:20 +0100] conn=299 op=164 msgId=166 - SRCH base="ou=services,ou=infrastructure,o=northampton,dc=dataforce-
dev,dc=co,dc=uk" scope=1 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="objectClass numSubordinates ref aci"
[30/Aug/2005:16:41:20 +0100] conn=299 op=164 msgId=166 - RESULT err=0 tag=101 nentries=41 etime=0
[30/Aug/2005:16:41:28 +0100] conn=299 op=165 msgId=167 - SRCH base="ou=services,ou=infrastructure,o=northampton,dc=dataforce-
dev,dc=co,dc=uk" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="objectClass numSubordinates ref aci"
[30/Aug/2005:16:41:28 +0100] conn=299 op=165 msgId=167 - RESULT err=0 tag=101 nentries=1 etime=0
[30/Aug/2005:16:41:28 +0100] conn=299 op=166 msgId=168 - SRCH base="ou=services,ou=infrastructure,o=northampton,dc=dataforce-
dev,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(objectClass=*)(objectClass=ldapsubentry)))(obj
ectClass=referral)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=netscapeServer)(objectClass=netscape
Resource)(objectClass=domain))" attrs="objectClass numSubordinates ref aci"
[30/Aug/2005:16:41:29 +0100] conn=299 op=166 msgId=168 - RESULT err=0 tag=101 nentries=41 etime=1
[30/Aug/2005:16:41:29 +0100] conn=299 op=167 msgId=169 - SRCH base="ou=iplanetamauthservice,ou=services,ou=infrastructure,o=n
orthampton,dc=dataforce-dev,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(objectClass=*)(objectC
lass=ldapsubentry)))(objectClass=referral)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=netscapeServ
er)(objectClass=netscapeResource)(objectClass=domain))" attrs="dn"
[30/Aug/2005:16:41:29 +0100] conn=299 op=167 msgId=169 - RESULT err=0 tag=101 nentries=1 etime=0
[30/Aug/2005:16:41:29 +0100] conn=299 op=168 msgId=170 - ABANDON targetop=NOTFOUND msgid=169
[30/Aug/2005:16:41:29 +0100] conn=299 op=169 msgId=171 - SRCH base="ou=iplanetamauthldapservice,ou=services,ou=infrastructure
,o=northampton,dc=dataforce-dev,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(objectClass=*)(obj
ectClass=ldapsubentry)))(objectClass=referral)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=netscape
Server)(objectClass=netscapeResource)(objectClass=domain))" attrs="dn"
[30/Aug/2005:16:41:29 +0100] conn=299 op=169 msgId=171 - RESULT err=0 tag=101 nentries=1 etime=0
[30/Aug/2005:16:41:29 +0100] conn=299 op=170 msgId=172 - ABANDON targetop=NOTFOUND msgid=171
[30/Aug/2005:16:41:29 +0100] conn=299 op=171 msgId=173 - SRCH base="ou=iplanetampolicyconfigservice,ou=services,ou=infrastruc
ture,o=northampton,dc=dataforce-dev,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(objectClass=*)
(objectClass=ldapsubentry)))(objectClass=referral)(objectClass=organization)(objectClass=organizationalUnit)(objectClass=nets
capeServer)(objectClass=netscapeResource)(objectClass=domain))" attrs="dn"
[30/Aug/2005:16:41:29 +0100] conn=299 op=171 msgId=173 - RESULT err=0 tag=101 nentries=1 etime=0
[30/Aug/2005:16:41:29 +0100] conn=299 op=172 msgId=174 - ABANDON targetop=NOTFOUND msgid=173
[30/Aug/2005:16:41:29 +0100] conn=299 op=173 msgId=175 - SRCH base="ou=iplanetamauthenticationdomainconfigservice,ou=services
,ou=infrastructure,o=northampton,dc=dataforce-dev,dc=co,dc=uk" scope=1 filter="(|(&(numSubordinates=*)(numSubordinates>=1)(|(
--More--(83%)
The list goes on.
Can anyone give me any pointers?
Thanks

Hi
Thanks for your reply!
I did mis-type, my mistake - sorry about that.
If I dont over-ride the default it works, I've pretty much got the whole setup working now but I'm not particularly over the moon about the way the ldap tree is setup, I'd like finer granuality as we are going to attempt to get syncronization working with AD.
I have an idea about how I'd like to set up our Mail/Calendar/LDAP infrastructure the 2nd time around (I'm just testing at the mo) - so I might have a question or two for you if you dont mind taking a look when you have a minute?
Thanks Jay

SCCM 2012: Active Directory Group Discovery, Delta Discovery?

Hi,
Our scenario:
*Software is requested via a seperate system which puts AD computer objects in groups
*Software within SCCM 2012 is deployed to computer collections
*Computer collections query AD groups, in those AD groups the pc's reside
*Collections memberships run via AD query (every 20 minutes)
*We deploy an OS (Windows 7) via SCCM
*Machine policy is updates every 20 minutes
What is important: AD Group discovery is set to full discovery every 7 days, delta discovery set to 15 minutes
So what happens:
*Pc is staged correctly with Windows 7 but software isn't coming through in time (sometimes it's there within the hour, sometimes it takes 6 hours)
*If we run a full AD Group discovery mostly software is installing immediately
*Sometimes a SCCM 2012 client machine reset policy or reinstall client solves the problem
My questions:
*Would it be better to run full discoveries every x minutes since this always solves our problem
*Would it be better to disable the delta discovery if we do the change above to minimize AD queries
=> tried that now (full discovery every 30 minutes and disabled delta discovery) but I don't want to put to much pressure on our domain controller
*Our software collections are limited to all systems, we could limit them to a Windows 7 collection. Probably we should do that but any suggestion how to do this safely in Powershell?
Please advise.
J.
Jan Hoedt
Note: what I don't get is why a full ad discovery system discovery sovles the problem since SCCM 2012 collections do a AD query, what 's the link there?

So, let me see if I get this correct for our situation:
Our own developed system puts pc’s in AD groups
SCCM 2012 polls these groups, by default 1/week full discovery then every 30 minutes a delta discovery
We deploy software to computer collections, these collections check the SCCM 2012 database every 30 minutes (collection update) Note: the query our collection do, is based upon requirement of Windows 6.1 + membership of an AD group.
The SCCM 2012 client/computer does a computer policy update every 30 minutes to see what collections it is member of and see then the software to be deployed
2 questions:
*Our my assumptions correct? Specifically point 3.: is the query fully coming from an ad sync (or also from sccm client, f.e. Windows 6.1%)?
*Don’t we have a step to much then, wouldn’t it be better to add a direct membership of the AD group within SCCM? This direct membership would mean no query and so save us about 20 minutes (run of query)?
Jan Hoedt

How to configure Email notification for User login's in Exchange Infrastructure?

How to configure Email notification for User login's in Client Machines?

Hi ,
Based on the description , you need to assign logon scripts to the end users via group policy and also use your exchange server as the smtp server in that logon script to relay emails to the internal recipients.
Thanks & Regards S.Nithyanandham

How to Configure Displayed flds,Sort criteria,Grouping crit-Cap Planning

Hi All,
Please let me know
How to Configure Displayed flds,Sort criteria,Grouping crit under Capacity Planning (Profile for List Variant-Sub Profile)
I want to create new Displayed flds,Sort criteria,Grouping crit
Prabakaran K

dear,
use CY40

How to check SCCM 2012 SP1 license?

Hi,
I have SCCM 2012 SP1 and the program is licensed.
I must know :
1. How to check SCCM 2012 SP1 edition is Standard or Datacenter?
2. How limit of SCEP (Endpoint Protection) client that can managed by SCCM 2012 SP1 Standard or Datacenter?
Regards, Bar Waelah

There is no limitations or feature changes between standard and datacenter.
You can read more about the new licensing model for System Center 2012 here:
http://www.microsoft.com/licensing/about-licensing/SystemCenter2012-R2.aspx
If you don't know which license you have bought i think you need to Contact Microsoft.

SCCM 2012 Win Updates - send only Metadata to Clients?

Hi Community!
Is it possible to configure SCCM 2012, so that Clients (Branch Offices) will receive only Metadata from our Server and will download the content directly from the Internet? And if, yes....can you tell us how?
We had this configuration before (without SCCM) with 2 WSUS Servers (one with Database and one with only Metadata) and both centrally Managed.
This was a perfect Solution for us. Now Management want to do this with only 1 SCCM Server (WSUS installed on SCCM Server).
Best Regards
Marcus

This can be done with ConfigMgr 2012 SP1 (not RTM). I'm not sure why you would want a LAN client to download content from Microsoft Update rather than their local Distribution Point, but you can do it per software update Deployment with the Download
Settings option:
"If software updates are not available on preferred distribution point or remote distribution point, download content from Microsoft Update"
When you make your deployment, don't distribute the content for the Deployment Package to any DP's, and then your clients should download it from the internet.
I hope that helps,
Nash
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
<-- If this post was helpful, please click "Vote as Helpful".

How can i create a new user with only read rights ?

How can i create a new user with only read rights ?

You are asking about a Database User I hope.
You can look into the Oracle 8i Documentation and find various privillages listed.
In particular, you may find:
Chapter 27 Privileges, Roles, and Security Policies
an intresting chapter.
You may want to do this with the various tools included with 8i - including the
Oracle DBA Studio - expand the Security node and you can create USERS and ROLES.
Or use SQL*Plus. To create a
user / password named John / Smith, you would login to SQL*Plus as System/manager (or other) and type in:
Create user John identified by Smith;
Grant CONNECT to John;
Grant SELECT ANY TABLE to John;
commit;
There is much more you can do
depending on your needs.
Please read the documentation.
-John
null

How to configure AP Express to function as only an access point.

I have AP Extreme Base station as my wireless router. I'd like to use my AP Express as only an access point for a secondary printer. I don't want to have the AP Express also serving as a range extender since it compromises my internet upload/downloads speeds. Can it be done?

I don't know
من جهاز الـ iPad الخاص بي
في ٢٥/٠٩/٢٠١٤، الساعة ١٢:٤٦ ص، كتب Apple Support Communities Updates <[email protected]>:
New discussion activity
Bob Timmons has posted in the AirPort community.
How to configure AP Express to function as only an access point.
Nice work. "Join" is what you want.
To post a reply, go to the discussion in Apple Support Communities.
You are receiving this email from Apple Support Communities. You can change your email preferences in your Apple Support Communities Profile.
TM and copyright © 2014 Apple Inc. 1 Infinite Loop, MS 96-DM. Cupertino, CA 95014.
All Rights Reserved | Privacy Policy | Terms of Use | Apple Support

SCCM 2012 - Automatic User Device affinity - Not Working

Hi,
I need to enable the Automatic User Device affinity.
Have enabled following two group policy settings:
Audit account logon events
Audit logon events
In client settings User and Device Affinity
following is enabled:
User device affinity threshold (120 minutes)
User device affinity threshold (2 days)
Automatically configure user device affinity from usage data – True
However even after 2 days there is no user device relationship getting build.
Is there anything more required to be done?
Any logs or links to be referred for troubleshooting?
Regards,
Milind Dhuri.

Hi,
Please post this in SCCM 2012 forum.
tx.

How to change SCCM 2012 R2 Product key?

Dear All
I need changing SCCM 2012 R2 product Key i was using another company Product key by mistake, i discovered that after finishing installation and Configuration my server become a live now so can any one help me to change it.
note:-
No way to remove the site and reinstall again.
Thanks for your help in Advance.

You change your product key by running ConfigMgr 2012 setup. You can following this guide for how-to: http://www.ronnipedersen.com/2012/05/convert-system-center-2012-from-evaluation-to-full-product-version/
Normally this procedure is for changing the evaluation version of ConfigMgr 2012 to the full version by specifying a full version product key.
I have done a lot of ConfigMgr 2012 installations for various customers and the key has always been the same.
Thanks, but its already activated with another key and i cannot find this option

SCCM 2012 R2 User State Migration Win XP to Win 8.1 does not migrate Domain User Files

Hi @ all
i'm trying migrate Win XP Sp3 to Win 8.1 using SCCM 2012 R2. So i followed the how to from the SCCM Team.
https://blogs.technet.com/b/configmgrteam/archive/2013/09/12/how-to-migrate-user-data-from-win-xp-to-win-8-1-with-system-center-2012-r2-configmgr.aspx
All things worked fine, but the user files from my test Domain user are not restored.
Here some extracts of the loadstate log.
2014-01-07 15:49:16, Info                  [0x000000] User SCCM\test.user maps to S-1-5-21-2486663232-1734351201-1738771205-1113
2014-01-07 15:49:16, Info                  [0x000000] User TEST-COMPUTER\Administrator maps to TEST-COMPUTER\Administrator
2014-01-07 15:49:16, Error                 [0x000000] The account TEST-COMPUTER\User is chosen for migration, but the target does not have account TEST-COMPUTER\User. See documentation
on /lac, /lae, /ui, /ue and /uel options.
2014-01-07 15:49:16, Info                  [0x000000] Failed.[gle=0x00000006]
2014-01-07 15:49:16, Info                  [0x000000]   Unable to create a local account because /lac was not specified[gle=0x00000006]
2014-01-07 15:49:16, Info                  [0x000000] Entering MigCloseCurrentStore method
2014-01-07 15:49:16, Info                  [0x0801dc] Closing catalog file
2014-01-07 15:49:16, Info                  [0x0801dd] Deleting catalog file at C:\Windows\Temp\tmpF6E7.tmp\Temp\tmp9F3.tmp
2014-01-07 15:49:16, Info                  [0x000000] Leaving MigCloseCurrentStore method
2014-01-07 15:49:16, Info                  [0x000000] USMT Completed at 2014/01/07:15:49:16.078[gle=0x00000057]
The user sccm\test.user is my test user but, i cannot see any error in relation to that user.
Has some some an idea?
Thank you
Adrian

Hi,
I found a similar article for your reference.
http://blogs.technet.com/b/sudheesn/archive/2009/12/28/in-place-upgrade-from-windows-xp-to-windows-7.aspx
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

SCCM 2012 Recover "User State Recovery Key" after Deletion Policy has removed the key

I have a computer that was upgraded from Windows XP to 7 using SCCM 2012. The user's info was captured and restored, but found out a month later that some Outlook Archives are corrupt.
I had this happen before on a different user, but found out right away and was able to recover the User State Recovery Key and restore the files.
I have looked under Assets and Compliance, User State Migration, but the computer is not listed anymore.
I have done a file restore of the USMT.MIG file from three weeks ago, but can not extract the users files without the User State Recovery Key.
I have looked through the SQL tables and have only found the StateEncryptDecryptKey in the StateMigration table which will not work.
Environment:
Windows 2008 R2 SP1 SCCM 2012 Server
Windows 2008 R2 SP1 SQL 2012 Server
Any help would be appreciated.
Thanks,
Wendell

It worked! Thank you Jason!
I restored the server's Storage Folder from "State Migration Point" (USMT Folder) from the same date as the SQL database was restored from. Shut the SCCM server down while doing the SQL restore. Turned on the Server and was able
to pull out the User State Recovery Key.
Then reverted back by shutting down the SCCM server and restoring SQL database back to previous backup taken before starting.
Only issue I'm getting now is that SMS_EN_ADSERVICE_MONITOR has a warning
8400 Enrollment Point AD Service Control failed to read and configure the registry keys necessary for this component.
With checking everything out to make sure no issues have arised. I looked through the log adctrl.log and found some more errors about Failed to create instance of ADService Managed Component. error = -2147024809
Any help would be appreciated.
Thanks,
Wendell

HOW TO CONFIGURE MANAGER or APPROVER USER IN ACCESS REQUEST MANAGEMENT TO APPROVE OR REJECT REQUEST

hi sap gurus,
i configured grc 10 system successfully. I created one user: GR_AR_APP001 and assign following roles:
SAP_GRAC_ACCESS_APPROVER
SAP_GRAC_ACCESS_REQUEST_ADMIN
SAP_GRC_FN_BASE
SAP_GRC_FN_NUSINESS_USER
and I maintained GR_AR_APP001 in access control owners as "POINT OF CONTACT", "SECURITY LEAD" and "WORKFLOW ADMINISTRATOR"
but when i am creating access request for new user and defining MANAGER under user details tab as GR_AR_APP001.
the user GR_AR_APP001 is not receiving any request for APPROVE or REJECT in his WORK INBOX.
can u please guide me how to configure APPROVER or MANAGER to approve or reject request.
I will be very much thankful if you guide me successfully.

Hi Colleen,
thanks a lot for your time.
PIC1: I created one user: GR_AR_APP001
and assigned all the GRC ROLES.
PIC2: I assigned owner type to GR_AR_APP001 user : POINT OF CONTACT, SECURITY LEAD and WORKFLOW ADMINISTRATOR in NWBC ACCESS CONTROL OWNERS
PIC3: I created one EUP 980 (copied from default EUP)
PIC4: I maintained default manager as GR_AR_APP001 user in 980 EUP
PIC5: I selected SAP_GRAC_ACCESS_REQUEST process id
PIC6: I created one agent id as ZGRAC_MANAGER11 in which I added approver user id: GR_AR_APP001
PIC7: I saved agent id
PIC8: I added agent id as ZGRAC_MANAGER11 in stage5 in manager stage.
PIC9: I saved
PIC10: I maintained EUP 980 (in which I configured manager as GR_AR_APP001 user) in stage 5 task settings
PIC11: Maintain Route Mapping, I clicked on next
PIC12 and PIC13: I saved and activated.
After this process I created one request for new account and selected the manager as GR_AR_APP001 and one request is created with request no 9000000030.
now I logged into system by user GR_AR_APP001 and checked, there is no request under his work inbox.
please guide me at least one procedure, how to receive request in approver work inbox so that I can learn other procedures to configure approver as per our organization requirement.
thanks for your support Colleen.

How to configure SCCM 2012 discover user group only?

Similar Messages

Maybe you are looking for