Update SCCM Collection Update Schedules

By default, SCCM collections update once a week. this may or may not be sufficient for your needs. When you create a new Collection in Powershell, you can pass a -RefreshSchedule parameter.
Set-CMUserCollection and Set-CMDeviceCollection accept the -RefreshSchedule parameter though this doesn't appear to be documented anywhere - Google suggests long scripts to do this.

We wanted to set our user collections to update every 4 hours. It proved to be quite simple. First we created a new schedule object

$sched= New-CMSchedule -recurinterval Hours -recurcount 4

 Then we passed it to each user collection.

foreach ($x in Get-CMUserCollection){Set-CMUserCollection -name $x.name -RefreshSchedule $sched}

PXE Boot to run task sequence from shared NIC

Microsoft  offered this post on Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manger OSD

http://blogs.technet.com/b/configurationmgr/archive/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd.aspx

AD and SCCM Device Cleanup

This Script Removes devices from AD and SCCM that have not been logged onto in 90days, and have not reset thier device password in 120. It then goes on to check the User device affinity to ensure Devices are sorted to the same OU as the Primary owner. (Unless that user is a member of the service desk, then leave as is. it Also maintains a complete log of all changes.

$log="C:\temp\sorter.log
$date=get-date
$oulist=Get-ADOrganizationalUnit -LDAPFilter '(name=*)' -SearchBase 'OU=DEPT,DC=Domain,DC=com' -SearchScope OneLevel #get-oulist

########################################Cleanup Stale PC's##################

$t="Starting Purge on $date"
$t|out-file $log -append


#Collect Stale devices.
Foreach ($x in Get-QADComputer -NotLoggedOnFor 90 -PasswordNotChangedFor 120 -searchroot Domain.com/Dept/){
$t="$x.name was Purged on $date"
$t|out-file $log -append 
Write-host $t
#Remove from AD/SCCM
remove-cmdevice -devicename $x.name –force –confirm:$false  
remove-qadobject $x.DN –force –confirm:$false
 
}

$t="Purge complete on $date. "
$t|out-file $log -append

############################################## Object Sorter

$t="Starting Sort on $date"
$t|out-file $log -append

#get all computers
foreach ($z in Get-qadcomputer -searchroot "Domain.com/Dept/"){
$t=""
$x=get-cmdevice -name $z.name 
if (!$x.username){ #check for Assigned user. If none log, and move on.
$t=$z.dn+" no user attached - unable to move."
write-host $t
$t|out-file $log -append

}elseif((Get-ADUser $x.Username -Properties memberof).memberof -like "CN=ISM-ALL*"){ #if member of servicedesk, dont touch 

$t=$z.dn+" last used by service desk. Do not move.."
write-host $t
$t|out-file $log -append

}else{
$y=get-qaduser $x.UserName;

$f=$z.name.lenght+16
$G=$y.displayname.length+14
$zdn= $z.dn.substring($f)
$ydn= $y.dn.substring($g)
#write-host $f $zdn 
if($zDN -match $ydn){ #if user dn and PC dn match - move on.
 write-host $z.name " is properly located"
 $zdn=""
 $ydn=""
}else{
 $zdn=""
 $ydn=""
#sort based on DN.

Foreach ($q in $OUlist){
$q.Name
if ($y.DN -match $q.name){write-host "yes";$dept=$q.name}
}

$newou="Domain.com/Dept/"+ $dept +"/Computers"
$t=$z.dn+" moved to "+$newou
write-host $t
$t|out-file $log -append
Move-QADObject $z.dn -NewParentContainer $NewOU
$NewOU=""
}#end move if
}#end no user if
}#end dn match if

Adding Users Devices to a Collection by First and Last Name

Recently I was given a Set of User's Names to exclude from a deployment. Easy. Until I realized the deployment was deployed to devices, not users. I dropped the user list into a text file. First Last, each on its own line. I read the file and grabbed the username, then performed a User Device affinity check, throwing the associated computer into the exclusion collection.

$collectionname="Exclude Reader DC"

foreach ($x in gc C:\temp\adobe.txt){
$y=get-qaduser $x
$user="DOMAIN\"+$y.samaccountname
$z=Get-CMUserDeviceAffinity -UserName $user
#$q=Get-CMDevice -ResourceId $z.resourceid
#$q.name
$z.resourceid 
 Add-CMDeviceCollectionDirectMembershipRule -CollectionName $collectionname -ResourceId $z.resourceid   
}

Surface 3 - SCCM task Sequence Spordically Fails.

Boot The device by pressing power and holding down the Down volume to boot from USB. You can release the Down volume when the Surface logo appears.

It will then start recovery, and allow you to choose a Boot device. We choose, usb, and The device reboots into the Task Sequence.



Once running, we noticed that some would randomy fail to go.

On investigation, we discovered that the Date and Time were incorrect, and  this was causing the failure.

Press F8
Enter Time - Update the time to Current
Enter Date - Update date to Current.

Click Finish on the tasksequence error Screen, and in the cmd window enter tsbootshell, and press Enter to restart the sequence. (Dont close the window, however)

Powershell to Add / Remove a PC To SCCM Collection

This is one of those fun things. To Add a PC to the Collection MS makes you do it by Resource ID.
This means you need to lookup the Resource ID of the PC, which you can do by Name, before you dump it in.

 ADD:

 $x="PCNAME";$collectionname="Collection";Add-CMDeviceCollectionDirectMembershipRule -CollectionName $collectionname -ResourceId $(get-cmdevice -Name $x).ResourceID   

Removal is Simpler, as you simply need to specify the PC name and Collection name. 

REMOVE:

 Remove-CMDeviceCollectionDirectMembershipRule -CollectionName <String> -ResourceName <String> [-Force]  

Remove stale PC's from AD and SCCM

This script allow you to cleanup stale computers from AD and SCCM. This is seup as a 2 part process, but there is no reason why you couldnt string it all togeather.

The first portion reports on machines where no one has logged on in 60 days, and the Password on the computer account has not changed in 120. This is a good indicator that the machine is not actively in use. We export this to a CSV file.

 #Get-QADComputer -NotLoggedOnFor 60 -PasswordNotChangedFor 120 -searchroot yourdomain/OU |select-object Name, ParentContainer, DN | export-csv c:\tempoutdated.csv  

The second block remove the affected devices from AD and SCCM. Note the CSV file has a header line line above the column lines that should be removed.

 Foreach($x in Import-CSV “C:\tempoutdated.csv”){  
 $x.name  
 remove-cmdevice -devicename $x.name –force –confirm:$false  
 remove-qadobject $x.DN –force –confirm:$false  
 }  

You can also do it as a oneliner where the txt file contains a list of only PC Names.

Foreach($x in Import-CSV “C:\zzz.txt”){$x;remove-cmdevice -devicename $x –force –confirm:$false;get-qadComputer $x|remove-qadobject –force –confirm:$false} 

Powershell SCCM Device Collections by Physical Location (IP Subnet)

This Script generates device collections by Physical location based on IP Subnet.

 ForEach ($x in Import-csv "C:\subnetcol.csv"){  
 $z=$x.Coll  
 $z  
 $rule="IP Subnet Like"+$x.subnet  
 $query= "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.IPSubnets like '"+$x.subnet+"'"  
 $Schedule = New-CMSchedule –RecurInterval Days –RecurCount 1  
 New-CMDeviceCollection –Name $z –LimitingCollectionName "All Systems" –RefreshSchedule $Schedule -RefreshType "periodic"  
 Add-CMDeviceCollectionQueryMembershipRule -RuleName $rule -Collectionname $z -QueryExpression $query  
 }  

the input CSV should be formatted with one line per subnet and its associated location. the code is sloppy and when run, will error if a collection already exists, but will add the additional subnets to it.

 Subnet,coll  
 10.2.230.0,New_york-2575_Hwy_206                                                              ,  
 10.2.202.0,Chicago-626_College_Rd                                                              ,  
 10.1.137.0,Ottawa-291_Peeter_Douglas_Rd  

SCCM 2012 Automated Collections in Powershell

The following code generates device collections of XP Systems from  a series of All System - dept name collections. (IE all XP machines in finance dept, All XP machines in Sales)

 foreach($x in get-cmdevicecollection -name "All Systems -*"){  
 $u=$x.Name  
 $z=$x.Name.insert(3," XP ")  
 $u  
 $z  
 $rule="WinXP"  
 $Find="Microsoft Windows NT Workstation 5.1"  
 $query= "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like '"+$find+"'"  
 $Schedule = New-CMSchedule –RecurInterval Days –RecurCount 1  
 New-CMDeviceCollection –Name $z –LimitingCollectionName $u –RefreshSchedule $Schedule -RefreshType "periodic"  
 Add-CMDeviceCollectionQueryMembershipRule -RuleName $rule -Collectionname $z -QueryExpression $query  
 }