Is there an easy way to create collections based on my Active Directory OU's?

Customers often create collections in Configuration Manager to model their AD environment.  In some environments, with lots of OU's, this can get an bit overwhelming.  If you are like me, you see this as an opportunity to leverage some automation … PowerShell to the rescue!

The first thing that needs to be done is to get a list of OU's you want to create collections for.  This could be for Users or Devices.  In the example, I will be creating device collections.

Gathering the OU Information

AD provides us with a built-in tool that lets us quickly get a list of OU's in our domain using dsquery.

dsquery ou

This command will return a list of OU's in AD, all of them (up to the default 100 limit).  The only problem, they are in distinguished name (DN) format.  This is great, if we were building LDAP queries, but in Configuration Manager, to build collections based on OU, we need to use the canonical name (CN, not to be confused with container name in AD).
 
 Let's look for a way to convert these DN's to CN's.  We can use some PowerShell manipulation to help us out.
 
 Let's take our dsquery, and pipe it out to a couple of commands to help us out
 
 This first command allows us to strip the  Quotation marks from the beginning and end of each line. 

dsquery ou |% {$_.trimstart('"').trimend('"')} 

Next we want to add a Split command to break each DN apart into its on elements.   

dsquery ou | % {$_.trimstart('"').trimend('"')} | % {$_.Split(",")}

We add the next element, the Switch command.  This is like a Select Case command in VBS.  This allows us to read each split line, and decide what to do with it.  If it begins with:

• OU=, we remove the OU= and add a leading slash (/) and store it in $x
• DC=, we add a leading period (.) and store it in $y

dsquery ou | % {$_.trimstart('"').trimend('"')} | % {$_.Split(",") | % {switch -Wildcard ($_) { "OU=*" {$x = '/' + $_.substring(3)  + $x} ; "DC=*" {$y = $y + '.' + $_.substring(3)}}}
 

Then we need to concatenate our OU's and DC's together and clear our variables with the next step.  We also need to remove the leading period (.) from the first DC.  

dsquery ou | % {$_.trimstart('"').trimend('"')} | % {$_.Split(",") | % {switch -Wildcard ($_) { "OU=*" {$x = '/' + $_.substring(3)  + $x} ; "DC=*" {$y = $y + '.' + $_.substring(3)}}} ; $ou = $y.TrimStart('.') + $x ; $x='' ; $y='' 

Finally, we need to store the data in an array and then write it out to a text file.

$ous=@(); dsquery ou | % {$_.trimstart('"').trimend('"')} | % {$_.Split(",") | % {switch -Wildcard ($_) { "OU=*" {$x = '/' + $_.substring(3)  + $x} ; "DC=*" {$y = $y + '.' + $_.substring(3)}}} ; $ou = $y.TrimStart('.') + $x ; $x='' ; $y='' ; $ous = $ous + $ou} ; $ous | Out-File C:\test.txt

The results text file will look like this. 

You can edit it to remove the lines from OU's you do not wish to create as collections.

Creating Collection

For this next step, we are going to you are familiar friend, New-CMDeviceCollection.   We want to use our text file as input.  In this case I am going to use the same Canonical Name from AD as the name of the collection.  This allows the collections to line up nicely in the console and also when trying to find them in Reporting Services.

We are going to use the Get-Content (gc) PowerShell command to read the text file and pass output to are ConfigMgr CmdLet.

gc C:\test.txt | % {New-CMDeviceCollection -name $_ -limitingcollectionname "All Systems"}

You can change the limiting collection are get real fancy and make each collection limited to its OU Parent (maybe in a different blog posting).  Here we are being very straight forward and limiting our collections to All Systems.

The results of this will be a set of collections in the Device Collections node with the canonical name of the OU.  We created the collection, so now we need to add membership rules.

Adding Membership Rules

This can accomplished using the Add-CMDeviceCollectionQueryMembershipRule (don't try to say that 3 times fast.  Thank goodness for autocomplete in PowerShell!).  

gc C:\test.txt | % {Add-CMDeviceCollectionQueryMembershipRule -collectionname $_ -queryexpression ('select *  from  SMS_R_System where SMS_R_System.SystemOUName like "' + $_ + '"') -RuleName $_}

gc C:\test.txt

Pass the output to a ForEach loop to be consumed in the CmdLet

| % {Add-CMDeviceCollectionQueryMembershipRule

Give the CmdLet the name of the Collection (which is the canonical name in the text file)

-collectionname $_ 

The expression to be used to create the Query Rule (which again uses the canonical name from the text file)

-queryexpression ('select *  from  SMS_R_System where SMS_R_System.SystemOUName like "' + $_ + '"')

Then a name for the rule (using the canonical name)

-RuleName $_}
 

 
 Microsoft provides programming examples for illustration only,
 without warranty either expressed or implied, including, but not
 limited to, the implied warranties of merchantability and/or
 fitness for a particular purpose.

 This sample assumes that you are familiar with the programming
 language being demonstrated and the tools used to create and debug
 procedures. Microsoft support professionals can help explain the
 functionality of a particular procedure, but they will not modify
 these examples to provide added functionality or construct
 procedures to meet your specific needs. If you have limited
 programming experience, you may want to contact a Microsoft
 Certified Partner or the Microsoft fee-based consulting line at
 (800) 936-5200.

 For more information about Microsoft Certified Partners, please
 visit the following Microsoft Web site:
 https://partner.microsoft.com/global/30000104