Managing Application Installs and Uninstalls with AD Groups Tied to Applications

Question

Hi everyone,
I'm trying to come up with a way to manage application deployment and removal based on user collections that have corresponding security groups in AD. I'm using SCCM 2012 r2.
Historically, I've done the following to deploy applications: -
Create a new application, setting the user experience to install for system.
Create two device collections, one named install and the other named uninstall.
Create two application deployments, one to install (targeted at the install device collection) and one to uninstall (targeted at the uninstall device collection).
Add device to install collection to install application.
To uninstall the application, remove the device from the install collection and add it to the uninstall collection.
That has all been working great but moving forward, I'd like to manage deployment based on user collections. So I've approached this as follows: -
For installations, create a new application setting the user experience to install for user.
Create a security group in AD that corresponds to the new application.
Once SCCM synchronizes with AD and the new group appears under SCCM users, create a new user collection making the security group a direct member of the collection. Set the collection to update incrementally.
Create a required installation deployment for the new application and target it at user collection for the application.
Add a user object in AD to AD security group for the application.
Once everything syncs, the user logged on to a workstation gets the application. Up to here, everything works well.
For uninstalls, I've created an AD security group called Application Uninstalls and made domain users a member.
Once this synchronizes with SCCM, I've created a new user collection called Application Uninstalls and made the security group a direct member of the collection. Again, the collection is set to incremental update.
Create an uninstallation deployment for the new application and target it at the 'Application Uninstalls' collection.
The idea behind the uninstallation is to take advantage of the 'application installation deployments take priority over uninstallation deployments'. Because every user is a member of domain users, if they are not a member of the relevant security group to
have an application installed, then the application is automatically uninstalled. The trouble is, if I remove a user from the AD security group where they get the application, the uninstall deployment isn't kicking in like I would expect and removing the application.
Any thoughts? Is this a logical approach or is it flawed?
Any input appreciated!
Bazzaroo

Answer 1

if I'm reading what you are saying correctly, then has the user logged out and then back on? Since the deployment is to the collection based on group membership, the client would not know that the user is no longer a member of the targeted collection until
the user token has been updated, which happens at log off/log on time.
It does depend on the collection membership - if the collection membership is to the user group, so that the collection member shows the use group, then the log off/log on would be needed.
If the collection membership list displays the individual users, then obviously that collection needs to be updated, AND new policy retrieval at the client so that it knows that it is no longer targeted.
Then, you need an Application Deployment Evaluation Cycle, which is when the client checks to see if apps that are supposed to be installed are.
Wally Mead