Update SCCM Collection Update Schedules

By default, SCCM collections update once a week. this may or may not be sufficient for your needs. When you create a new Collection in Powershell, you can pass a -RefreshSchedule parameter.
Set-CMUserCollection and Set-CMDeviceCollection accept the -RefreshSchedule parameter though this doesn't appear to be documented anywhere - Google suggests long scripts to do this.

We wanted to set our user collections to update every 4 hours. It proved to be quite simple. First we created a new schedule object

$sched= New-CMSchedule -recurinterval Hours -recurcount 4

 Then we passed it to each user collection.

foreach ($x in Get-CMUserCollection){Set-CMUserCollection -name $x.name -RefreshSchedule $sched}

AD and SCCM Device Cleanup

This Script Removes devices from AD and SCCM that have not been logged onto in 90days, and have not reset thier device password in 120. It then goes on to check the User device affinity to ensure Devices are sorted to the same OU as the Primary owner. (Unless that user is a member of the service desk, then leave as is. it Also maintains a complete log of all changes.

$log="C:\temp\sorter.log
$date=get-date
$oulist=Get-ADOrganizationalUnit -LDAPFilter '(name=*)' -SearchBase 'OU=DEPT,DC=Domain,DC=com' -SearchScope OneLevel #get-oulist

########################################Cleanup Stale PC's##################

$t="Starting Purge on $date"
$t|out-file $log -append


#Collect Stale devices.
Foreach ($x in Get-QADComputer -NotLoggedOnFor 90 -PasswordNotChangedFor 120 -searchroot Domain.com/Dept/){
$t="$x.name was Purged on $date"
$t|out-file $log -append 
Write-host $t
#Remove from AD/SCCM
remove-cmdevice -devicename $x.name –force –confirm:$false  
remove-qadobject $x.DN –force –confirm:$false
 
}

$t="Purge complete on $date. "
$t|out-file $log -append

############################################## Object Sorter

$t="Starting Sort on $date"
$t|out-file $log -append

#get all computers
foreach ($z in Get-qadcomputer -searchroot "Domain.com/Dept/"){
$t=""
$x=get-cmdevice -name $z.name 
if (!$x.username){ #check for Assigned user. If none log, and move on.
$t=$z.dn+" no user attached - unable to move."
write-host $t
$t|out-file $log -append

}elseif((Get-ADUser $x.Username -Properties memberof).memberof -like "CN=ISM-ALL*"){ #if member of servicedesk, dont touch 

$t=$z.dn+" last used by service desk. Do not move.."
write-host $t
$t|out-file $log -append

}else{
$y=get-qaduser $x.UserName;

$f=$z.name.lenght+16
$G=$y.displayname.length+14
$zdn= $z.dn.substring($f)
$ydn= $y.dn.substring($g)
#write-host $f $zdn 
if($zDN -match $ydn){ #if user dn and PC dn match - move on.
 write-host $z.name " is properly located"
 $zdn=""
 $ydn=""
}else{
 $zdn=""
 $ydn=""
#sort based on DN.

Foreach ($q in $OUlist){
$q.Name
if ($y.DN -match $q.name){write-host "yes";$dept=$q.name}
}

$newou="Domain.com/Dept/"+ $dept +"/Computers"
$t=$z.dn+" moved to "+$newou
write-host $t
$t|out-file $log -append
Move-QADObject $z.dn -NewParentContainer $NewOU
$NewOU=""
}#end move if
}#end no user if
}#end dn match if

Adding Users Devices to a Collection by First and Last Name

Recently I was given a Set of User's Names to exclude from a deployment. Easy. Until I realized the deployment was deployed to devices, not users. I dropped the user list into a text file. First Last, each on its own line. I read the file and grabbed the username, then performed a User Device affinity check, throwing the associated computer into the exclusion collection.

$collectionname="Exclude Reader DC"

foreach ($x in gc C:\temp\adobe.txt){
$y=get-qaduser $x
$user="DOMAIN\"+$y.samaccountname
$z=Get-CMUserDeviceAffinity -UserName $user
#$q=Get-CMDevice -ResourceId $z.resourceid
#$q.name
$z.resourceid 
 Add-CMDeviceCollectionDirectMembershipRule -CollectionName $collectionname -ResourceId $z.resourceid   
}

Teach yourself Powershell in 30 Pages

Ever want to teach yourself Microsoft Powershell?

This Guide from MS Switzerland is an excellent First step. though it was written in 2007, It is Awesome, and the first thing I point people too when they want to learn Powershell.

It Gives an Excellent Foundation, that you can build on from there.

Grab A Copy Here (PDF)


For Additional PowerShell Resources, Check Out:

Powershell to Add / Remove a PC To SCCM Collection

This is one of those fun things. To Add a PC to the Collection MS makes you do it by Resource ID.
This means you need to lookup the Resource ID of the PC, which you can do by Name, before you dump it in.

 ADD:

 $x="PCNAME";$collectionname="Collection";Add-CMDeviceCollectionDirectMembershipRule -CollectionName $collectionname -ResourceId $(get-cmdevice -Name $x).ResourceID   

Removal is Simpler, as you simply need to specify the PC name and Collection name. 

REMOVE:

 Remove-CMDeviceCollectionDirectMembershipRule -CollectionName <String> -ResourceName <String> [-Force]  

Remove stale PC's from AD and SCCM

This script allow you to cleanup stale computers from AD and SCCM. This is seup as a 2 part process, but there is no reason why you couldnt string it all togeather.

The first portion reports on machines where no one has logged on in 60 days, and the Password on the computer account has not changed in 120. This is a good indicator that the machine is not actively in use. We export this to a CSV file.

 #Get-QADComputer -NotLoggedOnFor 60 -PasswordNotChangedFor 120 -searchroot yourdomain/OU |select-object Name, ParentContainer, DN | export-csv c:\tempoutdated.csv  

The second block remove the affected devices from AD and SCCM. Note the CSV file has a header line line above the column lines that should be removed.

 Foreach($x in Import-CSV “C:\tempoutdated.csv”){  
 $x.name  
 remove-cmdevice -devicename $x.name –force –confirm:$false  
 remove-qadobject $x.DN –force –confirm:$false  
 }  

You can also do it as a oneliner where the txt file contains a list of only PC Names.

Foreach($x in Import-CSV “C:\zzz.txt”){$x;remove-cmdevice -devicename $x –force –confirm:$false;get-qadComputer $x|remove-qadobject –force –confirm:$false} 

Introductory Notes - Powershell Profile.

All Scripts assume Quest (Dell) AD Powershell Cmdlets and SCCM 2012R2 PS module.


I use the following Powershell Profile. This is a File called profile.ps1, located in %userprofile%\documents and preconfigures my environment.

The first line adds the  Quest (Dell) AD Powershell Cmdlets to my console.
The Second line Imports the SCCM2012 Powershell Module.
The third line changes my PS-drive to the SCCM Module.
Finally the last lines configure query limits to be higher then default.

 Add-PSSnapin quest.activeroles.admanagement  
 import-module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')  
 cd <SccmHierarchyName>:  
 set-qadpssnapinsettings -defaultsizelimit 0  
 set-cmqueryresultmaximum 50000  

Powershell SCCM Device Collections by Physical Location (IP Subnet)

This Script generates device collections by Physical location based on IP Subnet.

 ForEach ($x in Import-csv "C:\subnetcol.csv"){  
 $z=$x.Coll  
 $z  
 $rule="IP Subnet Like"+$x.subnet  
 $query= "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.IPSubnets like '"+$x.subnet+"'"  
 $Schedule = New-CMSchedule –RecurInterval Days –RecurCount 1  
 New-CMDeviceCollection –Name $z –LimitingCollectionName "All Systems" –RefreshSchedule $Schedule -RefreshType "periodic"  
 Add-CMDeviceCollectionQueryMembershipRule -RuleName $rule -Collectionname $z -QueryExpression $query  
 }  

the input CSV should be formatted with one line per subnet and its associated location. the code is sloppy and when run, will error if a collection already exists, but will add the additional subnets to it.

 Subnet,coll  
 10.2.230.0,New_york-2575_Hwy_206                                                              ,  
 10.2.202.0,Chicago-626_College_Rd                                                              ,  
 10.1.137.0,Ottawa-291_Peeter_Douglas_Rd  

SCCM 2012 Automated Collections in Powershell

The following code generates device collections of XP Systems from  a series of All System - dept name collections. (IE all XP machines in finance dept, All XP machines in Sales)

 foreach($x in get-cmdevicecollection -name "All Systems -*"){  
 $u=$x.Name  
 $z=$x.Name.insert(3," XP ")  
 $u  
 $z  
 $rule="WinXP"  
 $Find="Microsoft Windows NT Workstation 5.1"  
 $query= "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like '"+$find+"'"  
 $Schedule = New-CMSchedule –RecurInterval Days –RecurCount 1  
 New-CMDeviceCollection –Name $z –LimitingCollectionName $u –RefreshSchedule $Schedule -RefreshType "periodic"  
 Add-CMDeviceCollectionQueryMembershipRule -RuleName $rule -Collectionname $z -QueryExpression $query  
 }