We where talking to a customer about how to avoid waiting for Active Directory group synchronization to occur and place a device in the correct collections faster than “until the next synchronization”.

The main problem with this setup was caused by the fact that they used a group-in-group membership to identify collection memberships and apparently SCCM 2012 don’t include indirect changes to group membership as delta changes (I have not tested this in details yet).

So we came up with the idea to just create a direct membership to place the device in the collections instantly to make sure that it was there when the first policy is loaded on the client.

While that would work for cutting the synchronization time down to near nothing, it creates a new problem, any changes made to the group membership would not affect the collection correctly as a member would not be removed if a direct membership is still in place. So to fix this we need a process to clean up this mess.

The solution was fairly simple to do using a PowerShell script

Please note that the script is meant to run on the server using current credentials. The script was tested on SCCM 2012 SP1 and with PowerShell 3.0 and is provided as is, any comments and input are welcome.

Now let’s start coding …


First let’s create a function to and make the script simple to call using a few arguments.


Next we need to get the collection object from SCCM. Then we create two arrays for later use. Next we need to find all direct members of the collection, we store these in the $directmembers variable.


Before doing a lot of work we check to see if there was any directmembers, if not there is no reason to continue this process.


The we loop through all rules that contains a query. The query expression is run directly using WMI to get the members.

Any resources found using the query is then added to the $members array (if not already there).


Now that we have all directmembers and all members from any queries, we can do the cleanup.

We loop through all the direct rules and check if the referenced resource is found in the members array (that contains all members from any query)

If we find the resource, we can safely delete the direct rule from the collection.


Finally we request a membership refresh on the collection so that SCCM is in sync.


The last bit we need is to call the function using the arguments supplied


That’s it folks, now the collection only contains members that are either query-based or direct members and not both.

To call the script using a syntax like this, you will of cause have to replace sitecode and collectionid with your values.


The complete PowerShell script can be downloaded from the link below

Download “CollectionCleanup” CollectionCleanup1.zip – Downloaded 744 times – 1 KB