A Software package is being installed on computers that are not in the targeted collection

[jbudd0649]

I have a new software package that is only supposed to be installed on PC's in a specific collection. I configured the collection to query based on PC name. I have 163 members in the targeted collection, and for some reason the app is appearing on PC's that do not appear in the collection. I can see that the software package is only being deployed to the one collection. I have never seen this behavior before. Any ideas?

[anyweb]

did you verify the deployment(s) ?

[jbudd0649]

I did indeed. The application is called GoGuardian. I created a GoGuardian collection and deployed the package only to that collection. I had a query rule running based on PC name, the collection only had 163 clients. When I looked at the status messages for the deployment I saw clients that were not in the collection. I deleted the automatic query rule and manually added clients to the collection. I then re-created the deployment, again only targeting the GoGuardian collection. When I came in this morning and checked the status messages, I no longer see random clients installing the software. 

 

I don't understand why PC's outside of the collection would have gotten the software, maybe there was a problem with my query rule, but that doesn't explain why the random PC's got the software but didnt show as being part of the collection.

[GarthMJ]

Without looking at the logs, we are guessing but duplicate SMSID, Collection membership rules issues are places to look. 

[jbudd0649]

Thanks, Is an SMSID the same as a Windows SID?

I ran the following command against my domain controller:

ntdsutil "sec acc man" "co to se dc1@mydomain" "check dup sid" q q

 The command created an empty log file. I assume that means ntdsutil couldn't find any duplicate SID's.

 

My collection currently only has directly added members. When I first encountered the problem I was using a name query in the collection rule, but again, the collection only had 163 members and the software package was getting installed on PC's that were not showing as being members of the collection. If it was a problem with the query, I would have expected to see those PC's in my collection that were unintentional. 

 

[GarthMJ]

No SMSID is not the same as Windows SID. 

Try running this query. 

select * from sms_g_system_SYSTEM as g INNER JOIN sms_gh_system_SYSTEM as h on g.ResourceId = h.ResourceId where g.Name <> h.Name 

 

[xerxes2985]

I have had this happen before with a collection that still had old members in it. For example, when you move a computer to a different OU (if you have OU based collections), I have experienced where they get stuck, and manually updating the collection membership will remove those old computers.

[GarthMJ]

Just as a note, OU data will get returned to ConfigMgr via Heartbeat discovery. This means by default it will take 7 days or longer for the details to get returned.