Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm an SCCM newbie so maybe my question doesn't make any sense but please bear with me.

If I understand correctly, users become members of AD groups that represent software packages. If a user becomes a member of the AD group 'Winzip', SCCM detects this and distributes the Winzip package to the correct machine.

What if the user becomes a member of the AD group 'Sales' that is a member of the AD group 'Winzip'? So 'User' memberOf 'Sales' memberOf 'Winzip'. Will SCCM detect that the user should get the Winzip package? Or do I need to do something extra in this scenario?

Kind regards, Ronald Wildenberg

share|improve this question
up vote 3 down vote accepted

In SCCM, users and computers are put into Collections. The members of a collection are either manually added or added based on rules that query the SCCM database for things such as AD group membership. There are a ton of ways you can define rule based collections. I actually wish the documentation provided more real world examples on this topic. In any case, a user or computer can be a member of any number of these collections. It's not like Active Directory where an object can only live in one location.

Software Packages are distributed to these collections using Advertisements. An advertisement can only be assigned to a single collection.

The terminology in your original question is somewhat incorrect, but it sounds like you have the general idea. Let me see if I can clarify what it sounds like you've got set up.

You have a WinZip collection with the WinZip software package assigned to it with an advertisement. The members of the collection are determined by a rule that checks if the user/computer is a member of the AD security group also called WinZip. Users in your AD are not direct members of the WinZip security group. Instead, they are members of organizational groups like Sales. And in your example, the Sales group is a member of the WinZip group.

To answer your question finally, yes. If things are setup as I've described, users in the Sales group will have the WinZip application assigned to them. All of this will hinge on the various Active Directory Discovery methods being setup and working properly in your Site Settings. Changes to group memberships will only show up in SCCM after the next discovery processes have run and the collection update schedules have run. You can initiate both of these manually from the ConfigMgr Console if you want to speed things up.

The one thing most people have a hard time getting used to with SCCM is the lack of real-time changes. Just about everything in SCCM is based on a schedule. And you end up having to wait for successive scheduled things to complete before the changes you made will actually happen on the clients.

share|improve this answer
Thanks for the extensive answer. I've done some more research myself and I think I begin to understand the basic concepts of SCCM. – rwwilden Nov 11 '09 at 8:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.