I have a number of machines in MDT that belong to multiple roles. Nothing fancy there. However, in role A (which applies to most machines) the MachineObjectOU is specified, and in role B (which only applies to certain machines) a different MachineObjectOU is specified because those machines need to appear somewhere different in the directory. How do I guarantee that MDT will read settings from role B? Is it the order of roles in the list in the machine properties window?
Based on my experience and research, Role settings are applied on a first assignment wins basis, and the order of the roles in the MDT UI has no bearing on the order in which evaluation occurs. Instead,
RoleSettings (the MSSQL view that returns these settings) is queried with the following syntax:
SELECT * FROM RoleSettings WHERE ROLE IN ('List','of','Role','Names')
The results are returned and evaluated by database ID; so, if you created your roles in the following order:
Names List of Role
settings specified in
Names would, regardless of the order you specified, take precedence over those assigned in
Role. This seriously hampers the ability to use roles to modularize your deployment settings, unless you take especial care to pre-plan all of your roles. Even then, though, you're locked in to only ever using them in that order. As far as I can tell, there is no way to modify the ordering of results returned from
RoleSettings without digging into the scripts that actually perform the query and modifying them.