Migrate direct collection membership to AD group

Another powershell script. This one takes computers with direct membership in a collection and adds them to a AD group. Run it a second time and it removes the direct membership in the collection if the computer is a member of the AD group and if ConfigMgr knows that through AD discovery.

Import-Module ActiveDirectory
$SMSServer = "server1"
$SMSNamespace = "root\sms\site_SMS"
$SLA0 = ("C01000C8", "EntSCCM_SLA0") #AnyTime
$SLA2 = ("C0100060", "EntSCCM_SLA2") #Sunday
$SLA3 = ("C0100061", "EntSCCM_SLA3") #NoWindow
$colGroupArr = @($SLA0, $SLA2, $SLA3)

# If computer is a direct member of the collection we add it to the AD group.
# If the computer is a member of the AD group, and SCCM knows that, the direct membership is removed.
$colGroupArr | ForEach-Object {
    $Col, $Group = $_
    Write-Host Migrating computers from collectionID $col to AD group $Group
    $ADGroup = Get-ADGroup $Group
    # Get a SMS_Collection object to be able to use DeleteMembershipRule
    $delCol = get-wmiobject -query "select * from SMS_Collection where CollectionID = '$col'" -computername $SMSServer -namespace $SMSNamespace
    # Get all members of the collection
    get-wmiobject -query "select * from SMS_CM_RES_Coll_$Col" -computername $SMSServer -namespace $SMSNamespace | 
    Sort-Object -property Name |
    Where-Object {$_.IsDirect -eq $True} |
    ForEach-Object { 
        Clear-Variable ADComputer
        $ComputerName = $_.Name
        # Get the computer object from AD with Try-Catch so we do not get any errors printed out
        try {$ADComputer = Get-ADComputer $ComputerName -property memberOf}
        catch {Write-Host $ComputerName was not found in AD}
        If ($ADComputer.memberOf -eq $ADGroup.DistinguishedName) {
            # The computer is a member of the AD group. Check if ConfigMgr has discovered that
            $ADGroupSAM = $ADGroup.GroupScope.ToString() +'\\'+ $ADGroup.SamAccountName.ToString()
            $inGroup = get-wmiobject -query "select * from sms_r_system where name='$ComputerName' and systemgroupname='$ADGroupSam'" -computername $SMSServer -namespace $SMSNamespace
            If ($inGroup -ne $null) {
                # The computer is in group and ConfigMgr knows it so remove the direct membership
                Write-Host $ComputerName is a member of $ADGroup.SamAccountName so removing it from collection $delcol.Name
                $delCol.CollectionRules | 
                Where-Object {$_.RuleName -eq $ADComputer.Name -And $_.__CLASS -eq "SMS_CollectionRuleDirect"} | 
                ForEach-Object { $ReturnValue = $delCol.DeleteMembershipRule($_) }
            } Else {
                # The computer is in the group but ConfigMgr doesn't know that
                Write-Host $ComputerName is a member of $ADGroup.SamAccountName but ConfigMgr hasn"'"t discovered it yet
        } ElseIf ($ADComputer -ne $null) {
            # The computer is not a member of the AD group so add it
            Write-Host $ComputerName is a directMember in collection but not in group so adding it to $ADGroup.SamAccountName
            Add-ADGroupMember -Identity $ADGroup -Members $ADComputer
Comments (2) Trackbacks (0)
  1. I have been looking for something like this for a very long time. I just want to underatand a few things. First, I suppose I set the name of the collections that it will check in $colGroupArr and then when it should check it, but that’s where the information about this script is a bit fuzzy. I realize this is an old post and nobody has commented, so I’m trying my luck for an explanation from someone with a bit more experience. 🙂

    • Late response. Yes, you need to change all the stuff at the top. “CollectionID” and “AD group name” in the arrays $SLAn at the top. Then add those arrays to $collGroupArr. In my case i just named them “$SLAn” since that was what i was migrating at the time. And my example goes through 3 collections -> AD groups. You can add as many as you want.
      $SLA0 = (“C01000C8”, “EntSCCM_SLA0”) #AnyTime
      $SLA2 = (“C0100060”, “EntSCCM_SLA2”) #Sunday
      $SLA3 = (“C0100061”, “EntSCCM_SLA3”) #NoWindow
      $colGroupArr = @($SLA0, $SLA2, $SLA3)

Leave a comment

No trackbacks yet.