How to Best Using SCCM Filter Devices in a Specific Organizational Unit (OU)

Managing a large-scale IT infrastructure can quickly become chaotic if you do not have a reliable way to organize and target your endpoints. If you are running Microsoft Endpoint Configuration Manager (MECM), formerly and still affectionately known in the IT community as SCCM, you already know that Device Collections are the absolute backbone of your daily operations. They are the driving force behind software deployments, patch management, compliance settings, and endpoint security policies.

But what exactly happens when you need to deploy a specific software package or a critical zero-day security update exclusively to machines located within a single Active Directory Organizational Unit (OU)? Instead of manually searching for and adding devices one by one—a tedious, time-consuming process that completely defeats the purpose of enterprise automation—you can create a dynamic Device Collection. This collection will automatically filter and pull in devices based entirely on their current AD OU path.

In this comprehensive guide, we will walk through the exact steps to build a query-based collection in SCCM that specifically targets and filters devices by their Organizational Unit.

1. The Crucial Prerequisite: Active Directory System Discovery

Before we even touch the WQL query builder, there is a fundamental prerequisite that frequently trips up many system administrators. SCCM simply cannot filter devices by OU if it does not actually know which OUs those devices belong to in the first place. You must ensure that Active Directory System Discovery is enabled and properly configured to read your directory structure.

• Navigate to Administration > Hierarchy Configuration > Discovery Methods.
• Double-click on Active Directory System Discovery.
• Ensure the Enable Active Directory System Discovery checkbox is ticked.
• Check the Active Directory containers list. Make sure the specific OUs you want to query are actively included in the search paths.
• Most importantly, click on the Active Directory Attributes tab and verify that the System OU Name attribute is available in the list.

2. Creating the Target Device Collection

Now that SCCM is successfully reading your Active Directory structure and importing the metadata, it is time to build the dynamic collection.

1. Go to the Assets and Compliance workspace, expand Overview, and select Device Collections.
2. Right-click on Device Collections and choose Create Device Collection.
3. Give your collection a clear, descriptive name (for example, “Workstations – Finance Department”).
4. Choose an appropriate Limiting Collection. Selecting “All Systems” or “All Desktop and Server Clients” is a standard practice, but you can narrow it down further if you want to optimize the background evaluation times. Click Next to proceed.

3. Writing the WQL Query to Filter by OU

This is where the actual filtering takes place. We will set up a membership rule that dynamically updates itself based on the device’s location within Active Directory.

1. On the Membership Rules tab, click Add Rule and select Query Rule.
2. Name your query something recognizable (like “Finance OU Filter”) and click the Edit Query Statement button.
3. Switch directly to the Criteria tab and click the yellow star icon to add a new criterion.
4. Set the Criterion Type to Simple value and click the Select button.
5. In the Select Attribute window, configure the dropdowns exactly like this:
   • Attribute class: System Resource
   • Alias as: No Alias
   • Attribute: System OU Name
6. Click OK to return to the main Criterion Properties window.

4. Defining the Exact OU Path Value

Next, you need to define the exact path string. The Operator should be set to “is equal to”. However, when entering the Value, you must use the strict hierarchical format that SCCM expects, which is typically separated by forward slashes.

For example, if your domain is tolgakaya.local and your target OU is named Finance, which is nested inside a parent OU named Workstations, the required value format will look like this: TOLGAKAYA.LOCAL/WORKSTATIONS/FINANCE

If you are unsure of the exact syntax or spacing, simply click the Value button. SCCM will query its own database and present a list of all the discovered OUs in your environment. Selecting the correct path directly from that list is the best way to avoid frustrating typos.

Pro Tip for Sub-OUs: If you want to include devices in a parent OU as well as all of its child OUs, change the Operator to “is like” and append a wildcard percentage sign (%) at the end of the string. Example: TOLGAKAYA.LOCAL/WORKSTATIONS/FINANCE/%

5. Finalizing and Troubleshooting

Click OK on all the open dialog boxes and complete the wizard. SCCM will immediately begin evaluating the collection based on your new WQL query. Give the system a few minutes, hit refresh, and you should see the member count populate with the correct devices.

What if the collection is still showing zero members? If your collection remains empty after the initial evaluation, double-check these common culprits:

• Discovery Cycle Timing: The device might have been moved in AD recently, but SCCM has not run a Delta Discovery yet. You can manually force a discovery cycle to speed things up.
• Path Typos: A single misplaced letter or space in the WQL string will completely break the query. Always rely on the “Value” drop-down to let SCCM auto-fill the correct path.
• Client Health: Ensure the target machines actually have a healthy SCCM client installed, running, and actively communicating with your Management Point.

Mastering dynamic query rules based on Active Directory Organizational Units is an essential skill for maintaining a clean, highly targeted, and efficient endpoint management infrastructure.

Official Page: https://techcommunity.microsoft.com/category/microsoftintune/blog/configurationmanagerblog

Read more: How to Bypass the Microsoft Account Requirement During Windows 11 Installation