In my previous post I blogged about migrating collections from ConfigMgr. 2007 to ConfigMgr. 2012. This post will focus on some of the great collection changes you will see in ConfigMgr. 2012. First a quick recap of the new features:
- There are separate collections for Users and Devices. You can’t mix objects the two objects in the same collection anymore.
- There are two top collections, All Systems and All Users. Those collections can’t be deleted.
- All collections must be limited to another collection.
- Linked collections do not exist any longer.
- Sub collections do not exist any longer.
- Collections are part of the global dataset, meaning that collections will be visible at all sites.
- Two new query rules exist, Include and Exclude.
Using collection limitations
A very common question in the forum is how to split up administration of Servers and Workstations. For many this has been done by installing multiple ConfigMgr. 2007 sites. with ConfigMgr. 2012 you can control access by using RBAC (Role Based Access Control). By default the product ships with 13 predefined security roles.
In this example I will assign two different AD groups the Application administrator role and a limit the scope to the correct top level collection.
- Navigate to Overview, Security and Permissions, Administrative Users, Right click and create new user group
- Click Browse and select the correct group, in my example Desktop Admins.
- Click Add and assign the Application administrator role.
- Click Add and select Collection.
- Select Device collections.
- Select the correct top level collection. In this example I have All workstations which is the top level collection for all my desktops. Click OK to close the window.
- Remove all unwanted collections by selecting them and click Remove.
- Click Add and assign a security scope. In my example I have added the Default scope.
- Click OK.
- When you log in as a Desktop admin user all you will see, are the collections limited to the All Workstations collection.
- If you later limit another collection to All Workstations that collection will automatically be shown.
- In this example I have modified the collection properties for an existing collection and limited the collection to All Workstations.
- That’s it, security is not a valid reason to have multiple primary sites in ConfigMgr. 2012.