Collection Population in ConfigMgr 2007

My first WMUG article, hoping to keep it simple and not get to indepth. This first article of mine is looking at the population of collections within ConfigMgr 2007. We will look at the difference between direct collection membership and adding via Active Directory security groups.

So first of all we need to look at the process thats involved when you add a machine to a collection by each of these methods, first up is populating Active Directory Security groups.

1. Computer account is added to group in Active Directory
2. Active Directory replicates your changes across your domain controllers (15 minutes)
3. System Group Discovery runs (60 minutes)
4. Collection membership is updated via the collection evaluator schedule (60 minutes)
5. ConfigMgr client agent updates and new policy is downloaded (60 minutes).

So... this totals up to in a worse case scenario possibly 3 hours 15 minutes. Lets look at our next contender Direct Collection membership.

1. Administrator adds computer to collection
2. ConfigMgr client agent updates and new policy is downloaded (60 minutes).

Right there you have it, a total of 60 minutes. While you may have benefits of populating Active Directory groups which are members of collections for permissions reasons, for example, letting your Service Desk, Desktop Support or other teams perform software deployment via collections it may be worth you giving them permission to add direct membership to collections. Ouch I hear you say additional permissions, well it would let you concentrate on creating apps with the SDK or other ConfigMgr administrative tasks and let other support teams do this simple task.

So short and sweet, if you don't fancy letting others do this then think to yourself, why bother waiting at least 3 hours 15 minutes for an application when you could install it in 20 mins, in the same way you could argue the same for the whole suite as you know it does things in it's own time.

Special thanks to John Quirk for the theory on this.