The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If a Configuration Manager collection query that uses Active Directory group membership suddenly returns every user, no users, or stale members, the query is not necessarily the root cause. The result is produced by a chain: Active Directory discovery, resource data in the site database, WQL filtering, and collection evaluation. Test each layer in that order.
A December 28–29, 2021 forum case reported SMS_R_User.UserGroupName and SMS_R_User.SecurityGroupName queries returning all users in a Configuration Manager 2010 environment. The thread did not establish a final cause, so it should not be treated as proof of a current, product-wide outage. Read the historical report.
Understand where the membership decision is made
Configuration Manager does not query Active Directory live every time a collection is displayed. Discovery methods read directory objects and memberships, store resource data in the site database, and collection evaluation applies your WQL rule to that stored data.
- Active Directory: the user, computer, group, and nesting relationship exist here.
- Discovery: Group Discovery records groups and memberships; User Discovery and System Discovery supply fuller user and computer records.
- Site database: the discovered names, domains, resource identifiers, and group relationships are persisted here.
- Collection rule: WQL filters the discovered class and properties.
- Evaluation: the collection reevaluates and applies its limiting collection and other rules.
Because Group Discovery creates only limited user and computer information when it finds them as members, reliable user and device collections normally also require the corresponding User Discovery or System Discovery method. See Microsoft’s discovery-method documentation.
#1 Best Overall
Classify the symptom before changing anything
| Observed result | Likely areas to test first |
|---|---|
| Every user is returned | Wrong property, a null or stale property, or a domain/group value that does not match the stored data |
| No members are returned | Discovery scope, account permissions, group type, exact name, or domain prefix |
| Direct members appear but nested members do not | Direct-only query behavior or incomplete nested-group discovery |
| New members are delayed | Delta-discovery schedule, collection evaluation delay, or stale resource data |
| Removed members remain | Discovery did not complete, obsolete data remains, or the collection has not reevaluated |
| Full discovery works but delta discovery does not | The documented nested-OU delta-discovery issue |
| User collections fail but device collections work | User Discovery or SMS_R_User data |
| Results vary by domain prefix | NetBIOS versus DNS resource-domain values |
Run a controlled recovery test
- Record the current collection membership and the affected group’s distinguished name.
- Use one direct member, one nested member, one object outside the group, and one recently removed member as test resources.
- Run Active Directory Group Discovery. If a user or computer resource is missing or incomplete, run Active Directory User Discovery or System Discovery as well.
- Update or evaluate the collection after discovery completes.
- Compare the four test resources. This shows whether the failure is membership discovery, resource data, query logic, or evaluation.
Full discovery is more expensive but useful for rebuilding and validating the data set. Delta discovery uses fewer resources for ordinary changes, but it is not guaranteed to catch every topology or scope edge case. Microsoft recommends less aggressive full-discovery schedules and notes that Group Discovery generally need not run more often than every three hours; use delta discovery for routine changes where it works reliably. Scheduling guidance.
Validate the WQL rule against stored values
These examples resemble the historical report and are diagnostic examples, not universal drop-in rules:
select SMS_R_User.ResourceID, SMS_R_User.ResourceType, SMS_R_User.Name, SMS_R_User.UniqueUserName, SMS_R_User.WindowsNTDomain
from SMS_R_User
where SMS_R_User.UserGroupName = "DOMMySecurityGroupName"select SMS_R_User.ResourceID, SMS_R_User.ResourceType, SMS_R_User.Name, SMS_R_User.UniqueUserName, SMS_R_User.WindowsNTDomain
from SMS_R_User
where SMS_R_User.SecurityGroupName = "DOMMySecurityGroupName"- Use
SMS_R_Userfor a user collection and the appropriateSMS_R_Systemproperties for a device collection. - Confirm that the selected property is actually populated by your discovery configuration and Configuration Manager version.
- Match the group spelling and the domain representation exactly as Configuration Manager stores them.
- Preserve WQL quoting and the escaped backslash.
- Preview the query and inspect resource properties rather than assuming that
DOMis the correct prefix.
The forum case did not prove that either property was the final cause. Direct, one-level nested, and recursive membership are also different tests; do not assume a property performs recursive expansion in every version or class. Microsoft’s Q&A discussion illustrates this distinction while noting that behavior depends on the query and data being used: collection queries based on AD groups.
Check discovery configuration in the console
- Open the Configuration Manager console.
- Go to Administration > Hierarchy Configuration > Discovery Methods.
- Review Active Directory User Discovery, Active Directory System Discovery, and Active Directory Group Discovery.
- Open the applicable method’s properties and verify the domain or domain controller, discovery account, containers/OUs, and recursive-search settings.
- Confirm that the affected group is inside the configured scope and that distribution-group membership is enabled only when distribution groups are intentionally used.
Discovery accounts need permission to read the relevant containers and groups. The site server must resolve the configured domain controller and communicate with it. Check DNS SRV records, firewall paths, account expiry or lockout, changed passwords, and any scope exclusions. Microsoft describes these requirements and discovery behavior in its discovery documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Read the logs while reproducing the change
ADsgdis.log— Active Directory Security Group Discovery.ADUsrDis.log— Active Directory User Discovery.ADSysDis.log— Active Directory System Discovery.- Collection-evaluation and database logs for the site version.
- SQL Server and storage telemetry when operations are slow.
Search for the affected group’s distinguished name, the discovery scope, bind or access-denied errors, domain-controller resolution failures, added or removed members, skipped OUs, resource updates, and completion messages. Compare a full run with a delta run and note timestamps so discovery, database writes, and collection evaluation can be correlated.
Check the nested-OU delta-discovery issue
Microsoft documents a case where delta Active Directory Group Discovery can miss membership changes when groups are in nested OUs inside the discovery scope. Full discovery can find the same change because it uses a different algorithm. Test a group in the parent scope and another in a child OU, then compare full and delta runs.
If only full discovery detects the change, Microsoft’s documented workarounds are to move affected groups to a higher-level OU, add the child OUs explicitly to the discovery scope, or use full discovery for that scope. See AD group not discovered troubleshooting.
Check NetBIOS and DNS domain-name forms
A rule containing "DOMMySecurityGroupName" fails when the stored value uses a DNS-style domain, such as dom.example.comMySecurityGroupName. Inspect collection-preview results, Resource Explorer, or query results for the actual domain and group strings.
Microsoft also documents a version- and environment-dependent scenario in which resource-domain values alternate between NetBIOS and DNS forms, causing domain-qualified rules to add and remove resources unexpectedly. After confirming both values exist in your database, account for both in the rule, for example:
select *
from SMS_R_System
where SMS_R_System.SystemGroupName in
(
"AAAGroup1",
"BBBGroup1"
)The names above are placeholders; substitute only values you have verified. See Microsoft’s resource-domain troubleshooting article.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Separate incorrect data from slow processing
Slow discovery or evaluation can make a correct change appear late. It does not by itself explain why a query returns every user. The historical forum environment used Configuration Manager 2010, SQL Server Always On, and Nutanix storage; SQL queueing and storage performance were investigated, but the thread did not prove that either caused the membership error. Historical case details.
- Incorrect membership: prioritize query values, discovery scope, identity, group type, and stale resource data.
- Delayed membership: correlate discovery completion, collection evaluation, SQL waits, blocking, failovers, and storage latency.
- Site-wide instability: investigate database, management point, discovery-agent, and infrastructure health together.
Narrow Group Discovery to groups used by Configuration Manager, avoid unnecessarily broad recursive searches, and investigate long-running incremental collection queries. Microsoft’s remediation guidance also warns that overly broad limiting collections such as All Systems or All Users can contain discovery data without valid client information: management-insights guidance.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBest Value
Verify limiting collections and resource state
A correctly discovered resource can still be absent because the collection has not reevaluated, its limiting collection excludes the resource, the resource is obsolete or inactive, the wrong resource class is used, incremental evaluation is delayed or disabled, or another rule adds a filter. Inspect the collection’s limiting collection and all membership rules before changing discovery schedules.
When to escalate
Escalate with the exact WQL query, Configuration Manager version and hotfix level, affected group distinguished name, discovery scopes and accounts, direct/nested test results, timestamps, relevant discovery and evaluation logs, and SQL/storage latency evidence. This lets Microsoft determine whether the problem is configuration, a documented discovery edge case, stale database data, or a product defect. A paid license, SQL upgrade, or storage purchase should not be used as a substitute for that evidence.
Frequently Asked Questions
Does running full discovery permanently fix the collection?
No. It can refresh data and prove that delta discovery is missing a change, but the underlying scope, query, or topology issue may recur.
Can Group Discovery alone create a complete user collection?
Not generally. Group Discovery records groups and memberships but provides limited user and computer details; enable User Discovery or System Discovery for fuller resources.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why do nested members not appear?
The query may evaluate direct membership only, or nested discovery may be incomplete. Test direct and nested users separately and verify the configured discovery behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
