SCCM Device Collections: Targeting by Domain Controller Role

Here’s another Configuration Manager collection query, this time for building a device collection of everything acting as a Domain Controller.

The Query

select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_COMPUTER_SYSTEM.Roles like "%Domain_Controller%"

Using It

1. Create a new Device Collection under Assets and Compliance > Device Collections.
2. Add a Query Rule, switch to the Query Language tab, and paste the query above.
3. Save and give it a refresh cycle to populate.

This relies on the Roles property reported through hardware inventory (Win32_ComputerSystem’s roles list), which needs the client to have run hardware inventory recently to be accurate — a DC that’s had its role changed very recently might briefly show stale data until its next inventory cycle.

Why Build This Collection

A dedicated Domain Controller collection is useful for anything that needs to target DCs specifically without maintaining a manual list — applying DC-specific baselines, excluding DCs from general workstation/server maintenance windows, or scoping DC-only patch deployment rings separately from the rest of your server estate, since domain controllers typically warrant more cautious patching schedules than general member servers.

Variations Worth Knowing

The same query pattern works for other roles reported in the same inventory class — swap Domain_Controller for other role strings such as DHCP_Server, DNS_Server, or File_Server to build equivalent role-based collections. If a machine holds multiple roles, it’ll still match correctly since the query uses like "%...%" rather than an exact match, which is necessary because the Roles property can contain several role strings in one field.

Troubleshooting an Empty Collection

If the collection comes back empty even though you know you have domain controllers with the ConfigMgr client installed, check that hardware inventory is actually enabled for the Computer System class in your client settings — it’s on by default, but custom client settings policies sometimes trim inventory classes down, which would silently break this query without any error being shown.

Resources

• WQL
• query
• our SQL & WQL query library