I am trying to create a group in SCOM 2007 R2 based on the AD attribute DS_managedBy from a WMI query. I currently have a discovery that returns a list of all computer objects and the "managed by" attribute. Since this is an AD attribute, I am targeting the domain controllers object so that the query runs against the DC's which will return the entire list of computer objects where the managed by attribute is set. My question is how do we use the list of computers and managed by attributes that is returned to build a group based on what group manages a machine? Is there a better way to go about this?
There are two possible solutions to this situation, which I have stumbled across.
1) Create a new class that extends Windows Computer, create a script discovery that targets windows computer and in the script query AD for the value and then create a new instance of the class you created as well as populating the key property of the windows computer class. Return that new object to the management server via an API call. This is the option that I chose. Note that this option runs on every agent and queries AD for the computer attributes. In a large environment, this could cause some heavy traffic.
2) Note that I didn't do this method, but I am thinking it could be more efficient. Create a proxy agent on one machine and run the script against AD gathering all computer objects and attributes for each object. Loop through the result set and create a new object for each result and pass each one back to the management server. You would still have to create the custom class and discovery, but this would only run against a few machines (or possibly just one) and do all of the creation.
I found a lot of help by reading the SCOM authoring guide found here.