SCCM Collection Active Directory: Building One from an OU

Creating a Configuration Manager Collection Based on an Active Directory OU

If you want a Configuration Manager collection that automatically stays in sync with the membership of a specific Active Directory Organisational Unit — so anything moved into (or out of) that OU is reflected in the collection without manual upkeep — a query-based membership rule referencing the object’s distinguished name is the way to do it. For a user-based collection:

select SMS_R_USER.ResourceID, SMS_R_USER.ResourceType, SMS_R_USER.Name, SMS_R_USER.UniqueUserName, SMS_R_USER.WindowsNTDomain
from SMS_R_User
where SMS_R_User.DistinguishedName like "%OU=YourOUName,DC=yourdomain,DC=com"

Replace the OU=YourOUName,DC=yourdomain,DC=com portion with the actual distinguished name path of the Organisational Unit you want to base the collection on — get the exact DN from Active Directory Users and Computers’ Attribute Editor tab if you’re not sure of the precise formatting. The same pattern works for device-based collections by swapping in SMS_R_System in place of SMS_R_User. Because this relies on Configuration Manager’s Active Directory discovery having already picked up the object’s distinguished name, make sure System/User Discovery is enabled and has run recently, otherwise newly-moved objects won’t be reflected until the next discovery cycle.

Still Current on Configuration Manager 2603 (Updated for 2026)

This query pattern is unchanged on the current Configuration Manager release (2603) — SMS_R_User.DistinguishedName and SMS_R_System.DistinguishedName remain populated the same way by AD System/User Discovery, and the like "%OU=..." wildcard-match approach is still the standard technique for OU-scoped collections. One addition worth making: if the collection comes back empty right after moving objects into the target OU, it’s almost always discovery polling lag rather than a broken query — check the AD System/User Discovery method’s schedule under Administration > Discovery Methods and, if needed, trigger a manual “Run Full Discovery Now” rather than assuming the query itself is wrong.

Resources

• Active Directory
• WQL
• our SQL & WQL query library