Populatting SCSM database from SCCM

Ad_Bruil

Can any one explain how te SCSM database is populated from SCCM database? Is this append mode or override?

In Cireson I see more installations of a software asset then in SCCM. It looks that old data is not flushed from SCSM. On the otherhand, the data in SCCM is refreshed every time.

Is it possible to get the data in SCSM and SCSM in sync?

   

Eric_Krasner

No problem.  And if you think this is your answer, please mark it as such.  Thanks.

Matt_Medley

Eric_Krasner said:

Matt_Medley said:

Ad_Bruil said:

Many thanks, this will help.

If you create a domain admin account that has rights to Create/Modify/Delete AD objects and give it full administrative rights within SCCM, you can configure SCCM to delete the AD object when you delete the object from within SCCM. This seems to be a quicker route for some companies as they only have to delete the computer object in one place.

This can break all sorts of policy and procedures.  Make sure you understand the full impact of deleting AD objects in one fell swoop, especially if it is in error.  That is why we go through a two step processes of first disabling an account for x amount of days, then deleting it.

I do agree with you in every aspect, when used properly and procedures are followed, the option I mentioned works well. Accounts should be disabled for a minimum of 7-14 days before being deleted completely (my opinion). 

Eric_Krasner

What you most likely see are machine (Hardware Assets) that may no longer be deployed and hence, not in SCCM, but still in a status that is being used in the view you are using for the install count.

Ad_Bruil

Hello Eric, that's right, the question is, how can I clean up these hardware in SCSM/Cireson?

Eric_Krasner

If the machine no longer exists in SCCM, you then need to find out if the machine still exists in AD.  If the Machine is not in AD either, you can delete the Computer CI and the Hardware Asset.  However, if the computer is still in AD for some reason, it will recreate the CI on the next AD Connector sync and then the HW Asset will be recreated as well.  We have had to go through this process as well as we finalize our HW Asset normalization.

It will really help to create a number of views based on varying criteria to help identify Assets that need attention.

Ad_Bruil

Many thanks, this will help.

Eric_Krasner

No problem.  And if you think this is your answer, please mark it as such.  Thanks.

Matt_Medley

Ad_Bruil said:

Many thanks, this will help.

If you create a domain admin account that has rights to Create/Modify/Delete AD objects and give it full administrative rights within SCCM, you can configure SCCM to delete the AD object when you delete the object from within SCCM. This seems to be a quicker route for some companies as they only have to delete the computer object in one place.

Eric_Krasner

Matt_Medley said:

Ad_Bruil said:

Many thanks, this will help.

If you create a domain admin account that has rights to Create/Modify/Delete AD objects and give it full administrative rights within SCCM, you can configure SCCM to delete the AD object when you delete the object from within SCCM. This seems to be a quicker route for some companies as they only have to delete the computer object in one place.

This can break all sorts of policy and procedures.  Make sure you understand the full impact of deleting AD objects in one fell swoop, especially if it is in error.  That is why we go through a two step processes of first disabling an account for x amount of days, then deleting it.

Matt_Medley

Eric_Krasner said:

Matt_Medley said:

Ad_Bruil said:

Many thanks, this will help.

If you create a domain admin account that has rights to Create/Modify/Delete AD objects and give it full administrative rights within SCCM, you can configure SCCM to delete the AD object when you delete the object from within SCCM. This seems to be a quicker route for some companies as they only have to delete the computer object in one place.

This can break all sorts of policy and procedures.  Make sure you understand the full impact of deleting AD objects in one fell swoop, especially if it is in error.  That is why we go through a two step processes of first disabling an account for x amount of days, then deleting it.

I do agree with you in every aspect, when used properly and procedures are followed, the option I mentioned works well. Accounts should be disabled for a minimum of 7-14 days before being deleted completely (my opinion).