sccm boundary group site assignment

Configuring Discovery and Boundaries in SCCM

Once you install Configuration Manager, the initial configuration usually begins by configuring discovery methods. You want SCCM to discover the resources present in your network. SCCM comes built-in with several discovery methods. Most of them are not enabled by default. In this post we will see how to configure SCCM discovery methods. We will also see how to create boundary and boundary groups.

Table of Contents

Discovery Methods in SCCM

As mentioned earlier, there are several discovery methods in SCCM. The discovery identifies computer and user resources that you can manage using Configuration Manager . It can also discovers the network infrastructure in your environment.

Discovery creates a discovery data record (DDR) for each discovered object and stores this information in the SCCM database. When a resource is discovered the information about the resource is put in a file that is referred to as a discovery data record (DDR).

DDRs are processed by site servers and entered into the SCCM database . From there they are replicated by database-replication with all sites.

Types of Discovery Methods

Let us a take a look at discovery methods and understand what each discovery method does.

• Active Directory Forest Discovery – As the name suggests it discovers Active Directory sites and subnets. Once discovered it then creates boundaries for each site and subnet from the forests. Most of all you can automatically create the Active Directory or IP subnet boundaries that are within the discovered Active Directory Forests.
• SCCM Active Directory Group Discovery – This method discovers groups from the defined location in the Active Directory. The discovery process discovers local, global, and universal security groups. You can also discover the membership within these groups.
• Active Directory System Discovery – I think this is an important discovery method. This method discovers the computers in your organization from specified AD locations. In order to push SCCM clients on to the computers, the resources must be discovered first.
• Configuration Manager Active Directory User Discovery – This Discovery process discovers the user accounts from your Active Directory domain. You will have to specify the Active Directory container to search for the user accounts.
• HeartBeat Discovery – This is the only discovery method that is enabled by default. The HeartBeat Discovery runs on every SCCM client and is used by Active Configuration Manager clients to update their discovery records in the database. Furthermore the records are sent to the management point in specified duration of time. HeartBeat discovery is scheduled to run every 7 days.
• Network Discovery – The Network Discovery searches your network infrastructure for network devices that have an IP address. It can search the domains, SNMP devices and DHCP servers to find the resources. This includes printers, routers, and bridges.

Configure SCCM Discovery Methods

Now that we know what each SCCM discovery method does, we will configure each of them. Note that you can enable the discovery methods that you require.

Active Directory Forest Discovery

• Launch the System Center 2012 Configuration Manager Console.
• On the left pane select the Administration , expand Hierarchy Configuration.
• Select Discovery Methods . On the right pane double click “ Active Directory Forest Discovery ”.
• Check all the boxes to enable the AD Forest Discovery.
• Click Apply .

To run the full discovery as soon as possible, click Yes .

Active Directory Group Discovery

Double click the Active Directory Group Discovery . Check the box which says Enable Active Directory Group Discovery. Once you do that at the bottom you must specify either Groups or Location.

If you are choosing the first option i.e. groups , then you can add the multiple groups by specifying the distinguished name of the group. I prefer to choose the option Location .

Click Browse and specify the location. Select the Active Directory Container . Click OK .

Specify Group Name and click OK .

You should find the group name that you entered in the above step. Lets take a look at Polling Schedule .

Polling schedule is how often the Configuration Manager polls the AD to find the groups. You can change the polling schedule by clicking on Schedule button.

We will change Recur Every from 7 days to 2 days. So that means the Active Directory Group Discovery will Poll the AD for groups, every 2 days. Click OK .

Click Option tab. Check all the check boxes. The first option will discover computers that are active since 90 days . The second option will discover computers that have changed/updated their computer account password in a period of 90 days . The third option discovers the membership of distribution groups . Click Apply and OK .

Active Directory System Discovery

We will enable system discovery method. Right click Active Directory System Discovery and click properties .

Click Enable Active Directory System Discovery . To add the Active Directory Containers click Orange color icon.

Next, click Browse and select the domain .

Click Option and make the changes shown in the below screenshot.

Click Apply . Run the full discovery by clicking Yes . Click OK and close the properties page.

Active Directory User Discovery

We will now enable user discovery method. Double click Active Directory User Discovery , enable the active directory User Discovery . Add the Active Directory Containers . Click OK.

Boundaries and Boundary Groups in SCCM

As per Microsoft, a boundary is a network location on the intranet that can contain one or more devices that you want to manage. Boundaries can be either an IP subnet, Active Directory site name, IPv6 Prefix, or an IP address range.

To use a boundary, you must add the boundary to one or more boundary groups. Boundary groups are collections of boundaries. By using boundary groups, clients on the intranet can find an assigned site. In addition to that they can locate content such as applications, software updates, and operating system images. Active Directory Forest Discovery discovers boundaries automatically.

Lets take a look in the SCCM 2012 Console and find out whether a Boundary has been created or not. Bingo, the boundary has been discovered successfully.

Now we need to add the Boundary to the Boundary groups . To do so Select Boundary Groups , right Click and create a boundary group .

Provide a name as First Boundary Group . Click Add .

Select the boundary. In this case we only have a Default-First-Site-Name . Click OK .

Click on references tab , check Use this Boundary group for site assignment . To add the site system servers , click Add and select the Site System Server . Click OK.

Finally we see boundary group that we just created.

Select Boundaries from the left pane, right click the Default-First-Site-Name. Click Properties, under Boundary Groups you will find the First Boundary Group Added Automatically.

Sign Up For Newsletter

Join our newsletter to stay updated and receive all the top articles published on the site get the latest articles delivered straight to your inbox..

I have not unable to click in any option in MCM Window page

Check if the user account has permissions to perform those actions.

I am trying to create Boundaries However when I select (Active Direction Site) nothing is showing! what do you think?

Thank you in advance.

I’m implementing a new primary site to move from one server to another. Does heartbeat discovery discover devices across the network or ONLY within the boundaries that are set. I’m testing the new server and have added a boundary range of ONE ip address, my desktop. If I enable heartbeat discovery, will it only discover my desktop, or every desktop in our environment?

Hi Prajwal, I have an issue with boundary group. I am not able to find boundary group in the boundaries that exist in SCCM. It was there until last month, but today we noticed boundary group is missing from quite a few boundary and no site roles were assigned to it

in My SCCM Console i only can see “network Discovery” other discovery options are not showing.

Hi Prajwal,

I am facing issue in delay discovery of AD user group in SCCM, AD team created two new user groups 5 days ago in AD we have ran full discovery but it was not discovery after two days groups was discovered automatically. For test, AD team created one user group and many times we have ran full discovery but after 3 days the new group is not discovered.

why use of this of boundary and boundary groups and what happen without asign this boundary groups to site systems. please explain about this information sir, thank you sir

I want to point my external clients to a MP we have in the DMZ. I went into the boundary group that those clients are in and pointed it to the MP in the DMZ but they are still pointing at the primary server. Is there another way to do this? I have come across another post that suggested uninstalling the client and reinstalling the client with the MP in the syntax.

Hello Prajwal, Thank you again for the descriptive post. I have a query regarding settting up boundaries and groups: If we have only one AD site, 50+ remote offices, 2000+ clients, how can i setup the boundary groups so that i can specify different distribution points to remote offices? As reading your above post, i could see ip subnet may be the solution or should i configure forest discovery method initially ? Please suggest ….

You can use the IP address range instead of IP subnet as it works fine.

Hello Prajwal,   PFA, May i know how i resolve this ?

Did you find a resolution for your issue? I inherited a failed implementation of SCCM and i am having a similar issue.

Hello, I need to push software package to child domain, they device collection i can see in boundary group. How can i deploy package on these devices? Thanks

SIr, What are the log files for SCCM?

Check this – https://www.prajwaldesai.com/sccm-log-files/

Is there a way to setup network discovery to only look in a set IP range aka 10.1.1.1 – 10.1.1.254 for simplicity in OSD?

Hello Prajwal, first of all, great descriptive knowledge on SCCM versions. I’m a beginner in using sccm 2012 and we are trying to do a POC and hence started with the Microsoft’s SCCM eval version(180 days) available in VHD format which can be imported to a VM and bypassing all the installation trouble. I was wondering if you have any experience dealing with this VHD format, if so, the SCCM vhd is pre-configured with a domain ‘contoso’ and some dummy users/data. I wanted to know if there’s any way to manually add an IP range for a discovery. (note: the domain feature has been locked in the vhd format and hence unable to configure this as part of our domain system) any help would be appreciated. thanks again.

I am facing issue with the boundary. actually my client is going to push out of boundary network. what can be the issue. pls suggest if you can. It would be a great help.

When you run the Active Directory Forest Discovery the boundary(s) would have been discovered automatically.. Did you create a boundary group and add proper boundary to that boundary group ? Please check once..

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Save my name, email, and website in this browser for the next time I comment.

PatchMyPC Sponsored AD

Recast Sponsored AD

Popular Articles

SCCM 2012 R2 Step by Step Guide

How To Deploy Software Updates Using SCCM ConfigMgr

How to Install WSUS for SCCM | SUP Role | ConfigMgr

Fix Skype for Business Recording Shows Pending Status

Recent articles.

Install Google Drive using Intune [Enterprise App Catalog]

Deploy New Microsoft Teams using SCCM: Easy Guide

Fix “We’ve run into an issue” with new Microsoft Teams App

Bitwarden App Deployment using Intune: Easy Guide

Subscribe Newsletter

Subscribe to our newsletter to get our newest articles instantly!

• Our Services
• Free products
• Subscription

Configure SCCM 2012 Boundaries

Founder of System Center Dudes. Based in Montreal, Canada, Senior Microsoft SCCM Consultant, 8 times Enterprise Mobility MVP. Working in the industry since 1999. His specialization is designing, deploying and configuring SCCM, mass deployment of Windows operating systems, Office 365 and Intune deployments.

Benoit Lecours

Table of Content

Planning for sccm 2012 boundaries and boundary groups, overlapping boundaries, real world scenario.

• Create Site Assignement Boundary Group

Create Content Location Boundary Group

Get the latest insights and exclusive content delivered to your inbox

In this part of this SCCM 2012 and SCCM 1511  blog series, we will configure SCCM boundaries. First, let’s define what a boundary in SCCM is :

From Technet  :

In System Center 2012 Configuration Manager, a boundary is a network location on the intranet that can contain one or more devices that you want to manage. Boundaries can be an IP subnet, Active Directory site name, IPv6 Prefix, or an IP address range, and the hierarchy can include any combination of these boundary types. To use a boundary, you must add the boundary to one or more boundary groups. Boundary groups are collections of boundaries. By using boundary groups, clients on the intranet can find an assigned site and locate content when they have to install software, such as applications, software updates, and operating system images. A boundary does not enable clients to be managed at the network location. To manage a client, the boundary must be a member of a boundary group. Simple Boundaries on do nothing, they must be added to one or more boundary groups in order to work.

A boundary groups is self-explanatory, it’s a group of boundary used for for site assignment and for content location. Beginning with SCCM 2012 R2 SP1 , a boundary group can direct your clients to their Distribution Points for content, State Migration Point and Preferred Management Point . Prior to R2 SP1, Content location is used by client to identify available Distribution Points or State Migration Point based on the client network location.

To resume :

• Site Assignment boundary group associate a resource to a site
• Content Location boundary group is used to retrieve its deployment content (applications, packages, images, etc)

Before designing your strategy choose wisely on which bounday type to use.

If you’re unsure of which type of boundary to use you can read Jason Sandys  excellent post  about why you shouldn’t use IP Subnet boundaries.

Microsoft recommends the following :

• When designing your boundary strategy, we recommend you use boundaries that are based on Active Directory sites before using other boundary types. Where boundaries based on Active Directory sites are not an option, then use IP subnet or IPv6 boundaries. If none of these options are available to you, then leverage IP address range boundaries. This is because the site evaluates boundary members periodically, and the query required to assess members of an IP address range requires a substantially larger use of SQL Server resources than queries that assess members of other boundary types
• It’s also recommended to split your Site Assignment and Content location group

SCCM 2012 supports overlapping boundary configurations for content location.

When a client requests content, and the client network location belongs to multiple boundary groups, Configuration Manager sends the client a list of all Distribution Points that have the content.

This behavior enables the client to select the nearest server from which to transfer the content or state migration information.

In our various SCCM installations, our clients are often confused about this topic. Let’s make an example to help you understand :

• Contoso has 1000 clients
• 1 Primary Site (Montreal)
• 3 remote offices with their local Distribution Point (New York, Chicago, Los Angeles)
• Active Directory Site are based on their site subnets (MTL,NY,CHI,LA)

In that scenario, we need to create 4 Boundary, 1 for each office :

• Open the SCCM Console
• Go to Administration / Hierarchy Configuration / Boundary
• Right-click Boundaries and select  Create Boundary

• Tip : If you have multiples Active Directory Sites, IP Ranges or Subnets, you can enable Active Directory Forest Discovery which can create them automatically

Create Boundary Group

Now, we’ll create a Site Assignment Boundary Group and add all those AD Site. That way, all my clients for my 4 locations will be assigned to my Montreal Primary Site. For Content Location, we want clients to get their content locally at their respective location. We will create 4 Content Boundary groups, add only their AD Site Boundary and assign their local Distribution Point.

Here’s how to make this happen in SCCM :

• Go to Administration / Hierarchy Configuration / Boundary Groups
• Right-click Boundary Groups  and select  Create Boundary Groups

Create Site Assignement Boundary Group

• We’ll start by creating a group for Site Assignment : SA – MTL
• Click the Add bouton on the bottom
• On the Add Boudaries screen , select all boundaries. This will direct all my clients to the Primary Site located in Montreal for Site Assignment

• On the References tab, check the Use this boundary group for site assignment box
• Select your assigned site. In my case : MTL

• We’ll name our group Content Location – MTL
• Click on Add
• Select only the MTL boundary
• The MTL boundary will be listed

• On the References tab, uncheck the Use this boundary group for site assignment box
• Click on Add at the bottom
• Select the Site System that host the Distribution Point role for the Montreal site. For our example DPMTL01

• Repeat the steps for the other sites (New York, Chicago, Los Angeles)
• Once completed our clients are assigned to their local respective Site Systems

This is a simple but typical scenario. You can have multiples boundaries and Site System in your Boundary Groups if needed.

We hope this blog post was helpful for you, leave a comment or question using the comment section.

Only authorized users can leave comments

Brett Dalton

Ashish Kumar

The guys at PatchMyPc recently released a new product : Advanced Insight. Advanced Insight is a...

Over the years, we developed many Powershell scripts to make the life of an SCCM administrator...

SCCM CMPivot has been introduced in SCCM 1806 and it’s making its way to being a pretty...

Please fill out the form, and one of our representatives will contact you in Less Than 24 Hours . We are open from Monday to Friday .

Reports Guides Support

Consulting Services

Information

I'm interested in working with you

Consulting services and time banks are used for generic requests. All others are fixed-price plans.

Thank you for your request. You will receive an email with more details. Take note that we normally work from Monday to Friday. We will get in touch with you as soon as possible.

Thank for your reply!

Something went wrong!

How to setup a Raspberry Pi as an OpenVPN sharing gateway

• IKEA Lack Hack – DIY Computer Cabinet
• Clone your hard drive for free in 2021 – HDD to SSD – HD Clone X
• Restoring my old ICL 486 DX2/66 computer – Part 1 – Cleaning it up and first boot in 20 years!
• HOW-TO: Setup the OpenVPN server on a TP-Link AX1500 (Archer AX10)

Experiencing IT

Home » SCCM » SCCM Current Branch – Configuring Boundaries

SCCM Current Branch – Configuring Boundaries

After having configured the SCCM Discovery Methods , it is now time to configure its Boundaries and Boundary Groups.

As stated in this Technet article , in a nutshell, Boundaries represent network locations on the intranet where Configuration Manager clients are located. Boundary groups are logical groups of boundaries that provide clients access to resources.

So, let’s start with it!

Creating SCCM Boundaries

If all went good with the previously configured Discovery Methods, namely the Active Directory Forest Discovery, we should have already a boundary created. Let’s check it.

Open the Configuration Management console, click on “Administration”, expand “Hierarchy Configuration” and then click on “Boundaries”.

Boundaries are based on Active Directory Site Names. If you right-click the already created boundary and choose “Properties”, in the “General” tab, you’ll see that it is pointing to the “Default-First-Site-Name”, and if you click on the “Browse” button, in the list of available sites, you’ll only see that only one site, which is the “Default-First-Site-Name” site, is available.

If you want to rename the “Default-First-Site-Name” name, you should use the “Active Directory Sites and Services” console. Maybe I’ll write something up on that later on. For the sake of this article I’ll just use the name as it is per default.

Clicking on the “Boundary Groups” tab, you’ll see that no Boundary Groups are created yet. This should be done, because:

• They enable clients to find a primary site for client assignment (automatic site assignment).
• They can provide clients with a list of available site systems that have content after you associate the distribution point and state migration point site system servers with the boundary group.
• Beginning with System Center 2012 Configuration Manager SP2, they support management points and can provide clients with a list of preferred management points.

Read more about Boundary Groups and planning at the following Microsoft articles:

https://technet.microsoft.com/en-us/library/gg712679.aspx

https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/boundary-groups

Close all windows and let’s create the first boundary group!

Creating SCCM Boundary Groups

In the System Center Configuration Manager console, click on “Administration”, expand “Hierarchy Configuration” and click on “Boundary Groups”. Right-click on the blank space and choose “Create Boundary Group”.

In the “General” tab, give the boundary group a name and a short description.

Press the “Add…” button. Select the “Default-First-Site-Name” site and press “OK”.

Click on the “References” tab. Check the box for “Use this boundary group for site assignment” and press the “Add…” button. Select the site server and press “OK”.

Press “OK” again at the “Create Boundary Group” properties window.

Looking back at the properties of the “Default-First-Site-Name” boundary, we can see, in the Boundary Groups” tab, that the newly created boundary group is now showing in the list.

This concludes boundaries and boundary groups configuration and, this article!

Again, if you found this article useful, share it with your friends.

If you have any questions or suggestions, leave your comment.

Thank you for reading!

• ← SCCM Current Branch – Enabling Discovery Methods
• SCCM Current Branch – Adding the SUP role →

You May Also Like

Install SCCM Current Branch – Part 8 – Prerequisites (Windows ADK)

SCCM Software Updates Scan failed with error = 0xc80003f3

Install SCCM Current Branch – Part 6 – Add Site Server Local Admin

One thought on “ sccm current branch – configuring boundaries ”.

Pingback: SCCM Current Branch Installation Guides & More - ExperiencingIT

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Keep me updated of new posts!

This site uses Akismet to reduce spam. Learn how your comment data is processed .

Enjoy this blog? Please spread the word :)

In this video, I’m showing you how to set up a Raspberry Pi as an OpenVPN sharing gateway

Secondary Sites and Boundary Groups

Boundary Groups were introduced in ConfigMgr 2012 to combine boundaries together and give them one of two common purposes:

• Content Location
• Site Assignment

These are the same two things that boundaries were used for in ConfigMgr 2007; however, all boundaries were used for both purposes in 2007 and there was no way to separate them out. In 2012, you assign boundaries for one (or both) purposes by placing them into a Boundary Group. Also, unless a Boundary is in a Boundary Group, it is not used for anything.

Based on this, Boundary Groups can be classified as one of the two types (or both) based upon what they reference. For Content Location boundaries, the Boundary Group references a site system hosting a Distribution Point (DP):

A Content Location Boundary Group

and Site Assignment Boundary Groups reference sites:

A Site Assignment Boundary Group

This is pretty straight-forward but what’s not clear (from the documentation or console) is whether you should add a secondary site to a Site Assignment Boundary Group. There has also been some confusion in the forums, other blogs posts, and among us (the MVPs) about what you should or should not do and why.

The reason I’ve heard that you shouldn’t do this is because secondary sites don’t manage clients and thus clients can not be assigned to them. While this is a true statement, it is not a reason to not set a secondary site in a Site Assignment Boundary Group (beware of the double-negative in this sentence). Actual client site assignment is something the client does after it is installed – this site assignment process, if not specifically forced by the SMSSITECODE property during installation is smart enough to realize that the site code discovered through auto-site assignment is for a secondary site and thus the primary site code must be used. However, if you specifically force a client to install to a secondary site using SMSSITECODE=SS1, then you will run into problems – specifically, you’ll get the following message in ClientLocation.log: “Attempting to assign client to SS1 site that does not match assignment requirements”. This is ultimately no different than ConfigMgr 2007.

Note that by default, client push from the console hard-codes the use the the SMSSITECODE property to the primary site’s code; this shouldn’t be changed without very good reason. You can see this by navigating to Overview –> Site Configuration –> Sites in the Administration workspace, selecting a site in the details pane (primary or secondary), choosing Client Push Installation from the Client Installation Settings fly out menu on the ribbon bar (or right-click context menu), and finally selecting the Installation Properties tab on the Client Push Installation Properties dialog.

Client Installation Properties

So, should you or shouldn’t you use a secondary site in a Site Assignment Boundary Group? The answer is that both ways are valid. But, what’s the difference?

If you don’t use a secondary site in a Site Assignment Boundary Group, the only ramification is that during client push, the initial CCMSETUP files will come from the primary site server. This does not include all of the files required for client setup as those come off of DPs in ConfigMgr 2012. What this implies is that you must have a/the DP from the secondary site directly referenced in a Content Location Boundary Group that is applicable to the client is question based upon the boundaries that it contains.

The next obvious question (to me at least) is how would a client know if it is within the scope of a secondary site if there is no secondary site specified in a Site Assignment Boundary Group? The answer, although it is somewhat non-intuitive and maybe even backwards, is that a client uses Content Location Boundary Groups for this. Why does it do this? I can only speculate on this one, but my thinking is that this is not really a site assignment task. As mentioned above, clients aren’t really assigned to a secondary site; they are simply using the resources – MP, DP, SUP – at a secondary site. Also, site assignment is a one-time thing; once a client is assigned to a site, it will not try to re-detect the site it belongs to unless it is manually forced to do so. Content Location is an on-going, ad-hoc activity based upon the client’s current network status however. Thus, this lines up with a client’s ability to use other secondary sites or even go straight to the primary site depending upon where it is located network-wise.

Note that none of this implies that MPs are located using Content Location Boundary Groups, just the fact that a client is within the scope of a secondary. MP retrieval in ConfigMgr 2012 is not based on client location, just site assignment. The above also does not imply that clients will fallback to a primary site if the MP in the secondary site is down; when an MP at a secondary goes down, clients within the scope of that secondary are essentially on an island unless you change the Boundary Groups and wait for their 25 hour re-evaluation cycle or the clients detect a network change.

If you do use a secondary site in a Site Assignment Boundary Group, then client push will be initiated by the secondary site server and the initial CCMSETUP files will also come from that secondary site. The rest of the pre-requisite files and other files needed by CCMSETUP, will still come off a DP. So in reality, the difference between using a secondary site in a Site Assignment Boundary Group and not using it is just which site server initiates the push a single downloaded file from that site server: ccmsetup.exe.

A couple of things not to do with Boundary Groups when a secondary site exists include the following:

• Overlapping boundaries for Site Assignment Boundary Groups. Specifically, overlapping boundaries occur when two Boundaries assigned to two different Site Assignment Boundary Groups include the same set of IP addresses. These are officially unsupported and will cause odd results. Don’t do it.
• Use a Site Assignment Boundary for a secondary site without a Content Location Boundary Group. Although there aren’t any technical problems with doing this, it’s pointless to do this because clients will not use any of the site systems in the secondary site thus defeating the p urpose of the secondary site in the first place.

As a final recommendation, don’t mix your Site Assignment and Content Location Boundary Groups; i.e., don’t reference a site for Site Assignment and site systems for Content Location in the same Boundary Group. There are a couple of reasons for this including simplicity and conceptual separation. Another potential reason is because overlapping boundaries are in fact supported for Content Location.

Thanks to Aaron Keller for reviewing the above.

Next Article

Configmgr 2012 application deployment by example: user exe deployment, 22 comments, cancel reply.

Notify me of follow-up comments by email.

Notify me of new posts by email.

Currently you have JavaScript disabled. In order to post comments, please make sure JavaScript and Cookies are enabled, and reload the page. Click here for instructions on how to enable JavaScript in your browser.

“Note that none of this implies that MPs are located using Content Location Boundary Groups, just the fact that a client is within the scope of a secondary. MP retrieval in ConfigMgr 2012 is not based on client location, just site assignment. The above also does not imply that clients will fallback to a primary site if the MP in the secondary site is down; when an MP at a secondary goes down, clients within the scope of that secondary are essentially on an island unless you change the Boundary Groups and wait for their 25 hour re-evaluation cycle or the clients detect a network change”

I’m still a little confused about how clients decide which MP’s they use and which are available to them.

If I install a secondary site at the remote, are clients locating in secondary site boundary more likely to use the MP at the remote site?

If I just install an MP in the remote site, and do not install a secondary site, does this have any affect on what MP the clients in the remote site will choose?

Will clients in a primary site use the MP in the remote site, whether I install a secondary site at the remote site or not?

Ideally, I want the clients in my remote site using the MP (even if just most of the time) in the remote site, and my primary clients never using the MP in the remote site – do I need to setup a secondary site to achieve this?

Other question is whether database replication from Secondary to Primary is any better than just letting clients communicate directly to MP at primary site?

Thanks very much Shaun Croucher

Q. If I install a secondary site at the remote, are clients locating in secondary site boundary more likely to use the MP at the remote site? A. No — there is no “more likely” — they will always use the MP at the secondary site if they are within a content location boundary group for that secondary site.

Q. If I just install an MP in the remote site, and do not install a secondary site, does this have any affect on what MP the clients in the remote site will choose? A. No. Clients choose among multiple MPs within a primary site randomly. Actually, the prefer HTTPS capable MPs if the client is also HTTPS capable. Also, the lookup for an MP is done using the Global Catalog of AD so only MPs within the client’s forest can/will be available to the client. Barring these two caveats — HTTPS and forest — MP selection is random and not location aware or boundary enabled in any way.

Q. Will clients in a primary site use the MP in the remote site, whether I install a secondary site at the remote site or not? A. Maybe, as mentioned above, it’s essentially random.

Q. Ideally, I want the clients in my remote site using the MP (even if just most of the time) in the remote site, and my primary clients never using the MP in the remote site – do I need to setup a secondary site to achieve this? A. Yes. Multiple MPs within a primary site are only for availability.

Q. Other question is whether database replication from Secondary to Primary is any better than just letting clients communicate directly to MP at primary site? A. That depends upon the number of clients and the bandwidth between the MP and those clients. Generally, I would say yes for two related reasons: secondary sites can only have one MP and if that MP is unavailable, clients cannot fail over to any other MP automatically.

Note that the documentation listed at http://technet.microsoft.com/en-us/library/dd8eb74e-3490-446e-b328-e67f3e85c779#BKMK_Plan_Service_Location is incorrect or least gives a false impressions of MP selection and I am actively communicating with the documentation team to get it corrected.

Hello –

You could have a Secondary Site Server (SSS) defined within a BG like a ‘region / campus’.

On the SSS have MP, SUP, SMP, DP (and whatever else). Other locations within the region/campus then just get a DP. The advantage here is the regional MP helps with the upward flow of client traffic from the defined ‘region/campus’ and still allowing the downward deployment traffic to come from a DP in each building. So – I am thinking as far a Boundary Groups (BG) in this scenario would be: * BG1 = “All clients” (For site assignment) * BG2 = “Clients in the state of Michigan” – this would have a SSS with 4 roles (MP, SUP, SMP, DP) and have the boundaries for all sites (2 shown here) in Michigan * BG3 = “Clients in Detroit” = DTW * BG4 = “Clients in Grand Rapids” = GRR

Thus allowing all of Michigan clients to use 1 MP/SUP but each city having a DP/SMP using additional BG’s.

Correct? Agreed?

Thanks – – Andrew

Based upon the information provided, correct.

I’m not always a fan of using secondary sites because they are single points of failure in that clients will not do anything if the secondary site is not available — they are essentially orphaned until that secondary site server is restored to full functionality. Also, don’t overestimate the upward flow of traffic — it is often not impact-ful at all. For me, the choice to use a secondary site or not is a sliding scale with more clients and less bandwidth on the end of using a secondary site and less clients and more bandwidth on the side of just using a DP. This is a totally subjective scale and up to you to determine the exact thresholds based upon your knowledge of your network though.

I’m a little confused about Management Point selection in a Single Primary site environment, where the site server roles (DP’s MP’s etc) are spread over multiple locations in a multi-domain Forest.

When the Client selects an MP “Randomly from the AD forest”, is this from all available MP’s in the forest, or is the list ordered in some way based on sub-domain membership and/or AD Site constings.

From my testing, clients seem to prefer the MP’s from their local domain, which seems more logical, but contradicts what I keep reading.

Unfortunately, I can’t find any definitive documentation on the exact algorithm used.

You are correct. It prefers MPs in the same domain and same forest — the domain part is not listed in the official docs but I’ve gotten that straight from the product group and seen it in my own testing. AD sites are never considered though. The algorithm is fairly simple and will be the subject of my part of the MVP Experts panel next week Monday at TechEd (the video will be posted online sometime after the session).

Perfect – Thanks Jason. – Looking forward to seeing the video.

http://channel9.msdn.com/Events/TechEd/NorthAmerica/2014/PCIT-B410#fbid=

I have a follow up question related to the clients preferring MPs in their own domain. Take example AD Forest ABC.com with Domains EMEA.ABC.com and APAC.ABC.com MP1 is in forest root ABC.com and an MP2 is in domain EMEA.ABC.com. There are no MPs in domain APAC.ABC.com. With your assertion that clients will look in thier own domain first, I assume that clients in clients in EMEA.ABC.com will prefer MP2 since it is in the clients domain. Now will clients in the forest root prefer MP1, since MP2 is in a sub domain, or will they get back a list with both MP1 and MP2 as equal possibilities. How about clients in APAC.ABC.com? Since they don’t have any MPs in their domain, will they prefer MP1 in the forest root, or will they get back a list with MP1 and MP2 as equal possibilities, as both MPs are in the ABC.com forest, even though MP2 is in another domain?

“I assume that clients in clients in EMEA.ABC.com will prefer MP2” Correct.

“Now will clients in the forest root prefer MP1” Correct. MPs in the same domain are preferred over those in the same forest but not the same domain.

“clients in APAC.ABC.com … will … get back a list with MP1 and MP2 as equal possibilities” Since there are no MPs in the local domain for APAC clients, they will move on to the next criteria which is forest. There are two MPs in the same forest which will thus both be returned.

I asked our MS rep about this topic and received this response —

What criteria does the agent use to determine the closest management point based on its forest membership? The client uses AD to determine its network location, specifically the client compares the site boundary configuration with AD Site/Subnet configurations in Sites & Services to determine the “nearest” MP. After this the HTTPS/HTTP preference comes into play. Although MP functionality has evolved between 2007 & 2012 this aspect of the client hasn’t.”

Thoughts on this compared to the client using the domain and then forest as you indicated?

Unfortunately, that is totally incorrect. AD site and subnet configuration is never considered. My portion of the MVP Experts session at TechEd covers it pretty well: http://blog.configmgrftw.com/microsoft-system-center-2012-configuration-manager-mvp-experts-panel/ . The information presented is directly from first hand experience and testing as well as e-mail threads and discussions with multiple members of the product group including one of the developers.

To directly answer the question, there is no such thing as nearest as far as MPs go. The client asks an MP to return a list of MPs to it and this list is prioritized by domain, forest, and then non-forest MPs. If the client is HTTPS capable, then two lists are actually returned: one for HTTPS MPs and one for HTTP MPs. Based on this, the client will prefer MPs from the HTTPS list (if HTTPS capable) and then randomly from each of the categories in order of priority as mentioned.

A great post. It certainly filled some of the documented vs. real-world experience knowledge gap.

I have a question about Automatic Client Push and Boundary Groups.

I have a single primary site with 14 distribution points across WAN connections. I have configured 14 Boundary groups for Content Location using AD Site Boundaries, and assigned the applicable local distribution point to each Content Location BG. I also have a single Site Assignment Boundary Group, that includes all AD Sites and IP Subnet boundaries. Discovered clients are being successfully assigned to the primary site in the console, however are not being automatically pushed the SCCM 2012 client. I have successfully configured the Site Client Push settings.

Reading through some of your other posts, I think that my problem is that I do not have any site system servers assigned for use by my Site Assignment boundary group. I had assumed that content location BG’s would take care of that? Do different rules apply for the initial Client push content? Should I add my Primary site system to the Site Assignment BG? I’m a little concerned that If I add my Primary Site Distribution point to the Site assignment boundary group, then all packages forever more will be pulled across the WAN from the primary site.

Hope my rambling questions makes sense.

Thanks Jason

– Scott.

No, adding site system’s hosting DPs to the site assignment BGs won’t help and will cause content location issues. What you described above about your BGs in the first main paragraph is correct and sufficient.

To figure out why client’s aren’t getting the client agent pushed to them, you need to start by examining ccm.log on the site server.

I have Boundary Group question. My domain has 3 child domains and each child domain has 5 – 7 sites. Child 1 hosts the primary site with all roles and has a second site system server with DP role located at main data center. Child 2 is a secondary site with MP, DP and SUP roles. Child 3 is a site system server with DP, MP and SUP roles.

In your opinion, what is the best way to set up the Boundary Groups?

Thank you very much!

Boundary Groups should be based on DP and/or locations. Based on what you have above, it sounds like you have three total DPs. Thus, I would start with three boundary groups. Question though: Why do you have site systems in each child domain? Are the child domains geographically separated?

Hi, how to find , which client is associate with which boundary. is possible form sccm console or sql database.?

Yes, it is possible, but it depends upon the boundary types you are using. There is nothing built in that is exposed to handle this directly though. If you are using AD boundaries or IP Subnet boundaries, then it’s pretty easy actually as both of the attributes are reported up to ConfigMgr by the client. If you are using IP Address Range boundaries, then you have to include some logic in your query to determine whether a client falls into a boundary.

Hi, I have a question about fresh installed clients a a remote site. At the remote site we setup a secondary site which has two network adapters. One can communicate to our main network, where our primary site is located. The other is only a local network with no connectivity to the internet or somewhere else. We setup a pxe point on that secondary site and install clients within the capsuled network. This works fine and I get status messages back from the tasksequence. The problem is, that the clients don’t register or send ddrs to the primary site. I can only see them as “unknown”. Because of the capsuled network, the clients are not domain joined. When I look at the client, they always try to reach the mps from the primary site. I have set up a boundary for this network and assigned the DP/MP from the secondary site. As far as I know the clients should use the secondary sites mp as proxy to reach the primary site.

Do you know why the clients don’t use the secondary sites mp?

They do, just not for everything. Basically, what you are seeing is by design. Secondary sites are not and are not intended to be gateways. Clients *must* be able to communicate with an MP in the primary site — there is no other possibility and as mentioned this is by design.

Hi, Have a question here. We have one primary and two secondary sites. Have configured boundary group and associated preferred MP to that. However, i could see in console that client machine at secondary site shows secondary site MP in console and some shows primary site MP in console. Is that the correct way of working?

Preferred MPs are for MPs within a primary site *only*. Thus, unless you have multiple MPs in your primary site, using preferred MPs is useless and misleading. Clients use of an MP at a secondary site has nothing to do with preferred MPs.

SCCM Configmgr Report for Boundary group relationships with Fallback Sites

Beginning with configuration manager version 1702, clients use boundary groups to find a new software update point. You can add individual software update points to different boundary groups to control which site servers, a client can find the content or update scan.

More information about boundary groups and its relationship with  software update point changes in 1702 and 1706 ,please refer TechNet link  https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/boundary-groups ,it has lot of information than i explain.

Few weeks ago ,i was looking at the boundaries and boundary groups that are configured for my environment with fallback information (especially distribution point and software update point).

I find it hard to locate the boundaries that are configured with fallback distribution points and fallback software update point. In case you want to know the list of boundaries/boundary groups that are configured with fallback options,there is no default report.

I have created SSRS report that will help to gather information from SQL database into nice reporting .

Following are the options available for DP group to collect the information into reporting view.

References tab:

Relationships tab:

How does the report work ?

Download the report from Technet Gallary , upload the report into Configmgr SSRS reports folder,change the data source and run the report.

When you run the report, it prompt for Site Code since all the boundary groups that you created must have assigned to specific Site Code for site assignment. If you have not assigned the boundary groups to any specific site code, they will not be listed here .

So choose the Site Code (Primary or Secondary) or select All

Boundary groups that are assigned with specific Site Code will be listed with following information.

Boundary Group Name ,Site system Role,Site Code,Fallback Boundary Group,Fallback Site System,Fallback DP,Fallback SUP.

Hope it helps!

Share this:

Related posts.

Troubleshooting unexpected reboots caused by software center computer maintenance setting

Enhancing Troubleshooting with Verbose Logging in SCCM

Addressing SCCM Software Update Deployment Challenges with PowerShell – Remote install

Troubleshooting Co-Management wufb Workloads and the WMI StateMsg Namespace

5 responses to "sccm configmgr report for boundary group relationships with fallback sites".

Pingback: How to create a collection based on boundary group for client assignment and content troubleshooting | All about Microsoft Endpoint Manager

Thanks for the report! I imported it with success to our Reporting Services but I'm getting this error after selecting the Site and click on run:

The SELECT permission was denied on the object 'vSMS_BoundaryGroupRelationships', database 'CM_PT1', schema 'dbo'.

Any ideas? I saw this similar post but not sure what to do... http://eskonr.com/2016/12/sccm-configmgr-how-to-find-applications-with-no-deployments-as-part-of-maintenance-tasks/

Thanks for your help!

Cheers, Pedro

Fallback SUP,fallback DP information do exist only in SQL view vSMS_BoundaryGroupRelationships .The report is created to pull the information from vSMS_BoundaryGroupRelationships. Bring this your SCCM admin or SQL admin who can provide read access to schema dbo .

Regards, Eswar

Thanks Eswar for the report. The timing is great. The environment I'm working in at the moment has a single site. I had to modify the DataSet1 t-SQL a bit to get any results

select A.[Boundary GroupName], A.[Site System Role], A.[Site Code] , A.DestinationGroupName [Fallback Boundary Group] , UPPER(SUBSTRING(bgss.ServerNALPath,13,CHARINDEX('.', bgss.ServerNALPath) -13)) [Fallback Site System] , A.[Fallback DP], A.[Fallback SUP] from ( select bg.GroupID,bg.Name [Boundary GroupName] --, bg.DefaultSiteCode [Site Code] , case bg.DefaultSiteCode when '' then bgss.SiteCode else bg.DefaultSiteCode end AS [Site Code] , UPPER(SUBSTRING(BGSS.ServerNALPath,13,CHARINDEX('.', BGSS.ServerNALPath) -13)) [Site System Role] , bgrs.DestinationGroupName, bgrs.DestinationGroupID , case BGRS.FallbackDP when '-1' then 'No' when '120' then 'Yes' else NULL end as [Fallback DP] , case BGRS.FallbackSUP when '-1' then 'No' when '120' then 'Yes' else NULL end as [Fallback SUP] from vSMS_BoundaryGroup BG left join vSMS_BoundaryGroupSiteSystems BGSS on BG.GroupID=BGSS.GroupID left join vSMS_BoundaryGroupRelationships BGRS on bgrs.SourceGroupID=BG.GroupID where bg.DefaultSiteCode in (@Site) or bgss.SiteCode in (@Site) ) as A left join vSMS_BoundaryGroupSiteSystems BGSS on bgss.GroupID=A.DestinationGroupID order by 1

so you added defaultsitecode ? is that only change you did ? we dont use default sitecode for anything so i did not focus on this 🙂

Post Comment Cancel reply

Save my name, email, and website in this browser for the next time I comment.

Notify me of follow-up comments by email.

Notify me of new posts by email.

Configuring Boundaries for SCCM

by Manish | SCCM

In this post will be discussing on Configuring Boundaries for SCCM, this is a part of SCCM Current Branch Installation Guide series . I will be discussing on Boundaries as well as Boundary groups.

What are Boundaries and Boundary Groups

Creation of Boundary and Boundary group is one of the most important parts while configuring the settings for clients. This configuration helps getting the content from specific DP (Distribution Point) and to report to Management point based upon the settings we have specified.

Why do we need Boundaries?

Boundaries are required for 2 purposes:

• Site Assignment – Clients will get policies when assigned to a specific SCCM Site.
• Content Location – Clients will get the content from distribution point, hence proper boundaries should be defined so that they can get the content from appropriate source.

Note: If boundary is not configured for Site Assignment for clients, they won’t be able to communicate with SCCM to get the new policies targeted. Same way, if boundary is not configured for content location, clients won’t be able to get the content for patches / applications and packages / operating System deployment targeted to it.

Types of Boundaries

There are 4 types of Boundaries:

• Active Directory Site
• IPv6 Prefix
• IP address range Boundary Group

Once Boundaries are created, they won’t do anything until unless they are assigned to Boundary Group. Infact, Boundary Group is the actual step where we assign Site Systems for Site Assignment and Content Location.

Create Boundary

We are going to create Boundary based on “Active Directory Site” in configuration manager. Open SCCM console, Navigate to Administration \ Hierarchy Configuration . Right click Boundaries and select “ Create Boundary “

Specify Description as “ AD Site “, under type select “ Active Directory Site “. Click on Browse to select default site ie. “Default-First-Site-Name” and click OK.

Create Boundary Group

In this step we are going to create a Boundary Group, assign previously created boundary under this and assigning Site system servers under it. Navigate to Administration \ Hierarchy Configuration. Right click Boundary Groups and select “Create Boundary Group”

Under General Tab, specify the name as “ADsite”, Click on “Add”, select Boundary with description “ADSite” and click on OK.

Click on tab “References”, check the box “Use this boundary group for site assignment” (This step will make sure that clients will be getting the policies from this specific site). Under Site system Servers, click on “Add” and select SCCM01. (This site system server will be acting to provide content, patches to this specific Boundary group). Click on OK to complete the step.

Leave a Reply Cancel reply

Awards and recognition.

Manish Bangia

He is a Microsoft MVP in Enterprise Mobility domain. He specializes in Microsoft Intune family product and security which consists of Configuration Manager (SCCM), Intune, Co-management, Windows Autopilot etc.

Subscribe to Blog via Email

To get notification of new post by email.

Email Address

• Device configuration workload for MDM policy and SCCM co-management
• Configure FileVault disk encryption for macOS using Intune
• How to configure BitLocker on Windows devices using Intune
• How to create custom compliance policy in Intune
• How to use Endpoint Privilege Management using Intune

Configuring Boundaries and Boundary Groups in SCCM

• Post author By Sam
• Post date June 13, 2020
• No Comments on Configuring Boundaries and Boundary Groups in SCCM

What is a Boundary?

If you see the map of your country, you will notice that all the states are divided with a line, also known as the boundary. Why are they divided? Because every state may have its own policies and access to its own separate resources which are within that region. It is the same for SCCM.

In multi-regional environments, you will have to deal with machines belonging to multiple states or even countries. Machines belonging to a region would ideally want to access resources (like content, policies, etc.) that are either within the same region or nearest to that region. This is achieved through the concept of Boundaries and Boundary Groups.

Boundaries are used to group a set of machines that have something in common. They can be machines on the same floor of an office, or machines having the same Active Directory site assigned, etc. Boundary Groups, on the other hand, are used to configure the Site System Servers (like MP, DP, SUP), which those machines will try to access, when looking for policies, content, etc. They are also used for automatic Site assignment on the machines present within those Boundaries.

We can add more than one Boundary to a Boundary Group. So machines present in three different buildings (three different Boundaries) in the same region can have access to the same resources (using one Boundary Group).

Configuration

Boundary and Boundary group creation is done from the “Administration” node in the SCCM Console.

Creating a Boundary

Right-click on “Boundaries” and select “Create Boundary” to start the creation process.

As you can see above, I have selected the Boundary Type as “IP address range” and gave the required values. Now any machine having an IP address in the given range will belong to this Boundary.

Creating a Boundary Group

Right-click on “Boundary Groups” and select “Create Boundary Group” to start the creation process.

In the above screenshot, I have added the name of the Boundary Group along with a description and by clicking the “Add” button at the bottom, I have also added the IP range boundary which I just created. Now that boundary and all machines which lie in that boundary belong to this Boundary Group. But all this will be of no use until and unless we move on to the next step to configure automatic site assignment and Site System Server assignment.

If you click on the “References” tab of the same window, you’ll be able to add those configurations. Automatic Site Assignment can be done by just checking the highlighted checkbox and selecting the required Site through the drop-down box. The appropriate Site Servers can be added by clicking on the “Add” button and selecting the servers from a list. These Site Servers are going to be used by the machines in the IP range boundary to download content or policies or updates. So it’s best to select the Site Servers which are either located in the same region or nearest to the region where the machines are located in order to get the best performance.

• Tags Boundary , Boundary Group , MEM , SCCM

Hi, I am Samarth Joshi. Gaming got me into computers and programming, which ultimately led me to IT. Now just trying to share what I learn.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Save my name, email, and website in this browser for the next time I comment.

• Home  / 
• Uncategorized  / 

Back to Basics – ConfigMgr Distribution Points and Boundaries

Per request from a fellow tweep, here is crash course in ConfigMgr Distribution Points, Boundaries, and Boundary Groups.

Distribution Points

In ConfigMgr environments, the Distribution Points, or DPs, are simply there to store packages that client connects to for downloading software like applications, software updates, and OS deployment images etc.. To make sure clients are connected to the best DP, the one closest to the clients, boundaries are boundary groups are used.

Boundaries and Boundary Groups

Boundary Groups are a way to assign resources to clients, for example which DP, or Management Point (MP), or Software Update Point (SUP) to use. Boundary Groups can also be used to assign a client to the correct ConfigMgr site, even though most environments should only have a single primary site.

Anyway, ConfigMgr supports a variety of ways to put clients in a boundary, where the by far best method is to use IP ranges. Other methods (that I don't recommend) are IP subnets, and Active Directory sites. For example, if you have a subnet in New York, that is a 192.168.1.0/24 subnet, I recommend that you create an IP range boundary of 192.168.1.1 – 192.1698.1.254, assign it to a boundary group named New York, and configure it use a DP in New York.

Avoid Overlapping Boundaries

One of the most common reason for "weird things happening" in ConfigMgr is when there are overlapping boundaries, or when clients are members of multiple boundary groups, so just simply avoid that. My old football coach used to say KISS, Keep It Simple Stupid, and that goes a long way for ConfigMgr boundaries as well.

Reducing the number of Distribution Points

These days you want to try to reduce the number of DPs and use more peer to peer instead (DO, Peer Cache, and BranchCache). It's simply more efficient using hardware that is already out there, instead of managing yet another server.

Verifying Boundaries

A quick way to verify if clients are using the right Boundary Group, is to enable hardware inventory for the Boundary Group Cache (\\Computername\Root\CCM\LocationServices), and take a look every now and then in the v_GS_BOUNDARYGROUPCACHE view in SQL using the below query:

Another option is to simply ask the client directly using the below PowerShell code, and then collect the result on the server side as described in the A Holistic Approach to ConfigMgr Client Health blog post.

Verifying Distribution Points

A quick way to figure out which DP a client has been using is to parse the ContentTransferManager.log on the client with a bit of PowerShell, and then upload that info to a summary report. For example, I recently used this for a customer to figure out that clients in Argentina, was using a DP in Europe due to incorrect boundaries.

Johan Arwidmark

Hi Johan, On the subjects of DPs and boundaries let me throw in another variable – secondary sites. So I know they kind of suck and should be avoided but can you confirm my understanding here? I'm led to believe and have always advised people that the secondary site server has to be in the boundary group of any clients using the MP of secondary site. That's obviously counter-intuitive as normally you don't assign an MP that way but that's how I understand it and what I've been told. Am I correct in my understanding? If I am correct then …  Read more »

First, I recommend avoiding using secondary sites, and just stick with DP's. There are very few reasons for using secondary sites these days, and as far as boundary groups goes, MPs, DPs, and SUPs are connected to them. I don't have access to any environment with secondary sites anymore, but in general, if you want clients to use another, create a separate boundary/boundary group for them, and add that DP as a resource.

Hi! Thanks for this post! I hope I may ask some questions? 🙂 We use a site assignment (SA) boundary group with an AD site boundary and a content location (CL) boundary group with some of the ip ranges in the closer environment. To meet our needs we use ~150 Windows 10 LTSC based client distribution points in our (very small) branches. BranchCache will never work within these locations. So we configured boundaries for every branch (ip ranges) and a corresponding boundary group referenced with one client dp which is located on site. What do you recommend to set on …  Read more »

I'm curious to know why BranchCache won't work in that scenario, because in general, I try to avoid having lots and lots of DPs. Anyway, if you have a "real" DP in a location with just a few clients, there is little need to enable clients for Peer Cache in that scenario. That being said, the Peer check boxes in the options tab also affects Delivery Optimization settings via ConfigMgr, so you should leave them enabled.

BranchCache needs three or four clients involved to work I think? If all the clients within a branch start to install SU e.g. no one will use the BranchCache. Am I wrong? What do you think about the settings on Relationship?

No, BranchCache only needs one client to have the content in it's cache before it can peer to others. Relationship settings don't really affect BranchCache either.

Session expired

Please log in again. The login page will open in a new tab. After logging in you can close it and return to this page.

• Configuration Manager 2012

• Remember me Not recommended on shared computers

Forgot your password?

boundary groups site assignment explanation?

By ms-admin , February 12, 2014 in Configuration Manager 2012

• Reply to this topic
• Start new topic

Recommended Posts

• Report post

Hi, i'm wondering whether to use the 'use this boundary group for site assignment' option under the references tab. i've read the literature from microsoft here but i'm concerned by the following paragraph... "Site assignment is used by clients that use automatic site assignment to find an appropriate site to join, based on the clients current network location. After a client assigns to a site, the client will not change that site assignment. For example, if the client roams to a new network location that is represented by a boundary in a boundary group with a different site assignment, the client’s assigned site will remain unchanged." the drop down for assigned site shows all sites and i have one primary and three secondary sites which are all management points so i'm wondering if i should set this on each secondary to it's own site or to the primary site? thanks.

Share this post

Link to post, share on other sites.

Peter van der Woude

A client can only be assigned to a primary site and not to a central site, or a secondary site.

hi, so if i set a boundary group to a local secondary site code for automatic site assignment this will still get any clients assigned to the primary anyway? but if that's the case why not just have the single primary site on the list? what is the purpose of being able to select a secondary?

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

×   Pasted as rich text.    Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.    Display as a link instead

×   Your previous content has been restored.    Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

• Submit Reply
• Existing user? Sign In
• Online Users
• Leaderboard
• All Activity
• Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings , otherwise we'll assume you're okay to continue.

I forgot my password

Or sign in using

Don't have an account yet?

Create a free account

Sign in instead

Please wait...

Free Active Directory Course!

Active directory fundamentals.

Create your free account and get our free Active Directory course!

Review what you learned in this lesson!

Installing and Configuring System Center Configuration Manager (SCCM)

0/1 Lessons

Getting Started with this Course • 26min

0 / 3 lessons complete

SCCM Configuration Manager Overview Free Preview Lesson

Video | 8 min

Prerequisites in a Production Environment Free Preview Lesson

Video | 12 min

Configuration Manager Overview Section Quiz Free Preview Lesson

Quiz | 6 min

System Center Configuration Manager - Features and Capibilities • 31min

0 / 5 lessons complete

Asset Management Full Access Account Required

Video | 6 min

Administrative Tasks Full Access Account Required

Video | 5 min

Client Management Part 1 Full Access Account Required

Video | 7 min

Client Management Part 2 Full Access Account Required

Features and Capabilities Section Quiz Full Access Account Required

Quiz | 8 min

SCCM 1902 Lab Setup • 51min

0 / 12 lessons complete

This section is optional Full Access Account Required

Text | 1 min

Lab Overview Full Access Account Required

Video | 4 min

Downloading and Installing VirtualBox Full Access Account Required

Video | 2 min

Creating Your NAT Network and VMs Full Access Account Required

Downloading and Mounting Server 2019 ISO Full Access Account Required

Video | 3 min

Installing Windows Server 2019 Part 1 Full Access Account Required

Installing Windows Server 2019 Part 2 Full Access Account Required

Downloading and Mounting Windows 10 ISO Full Access Account Required

Installing Windows 10 Full Access Account Required

Configuring SADC01 Full Access Account Required

Video | 15 min

Configuring our SAWS01 Workstation Full Access Account Required

Configuring our SASCCM01 Server Full Access Account Required

Installing SCCM 1902 Installation • 1hr 32min

0 / 11 lessons complete

SCCM Compatability Check Full Access Account Required

Download Required SCCM Software Full Access Account Required

Installing the ADK Full Access Account Required

Creating the System Management Container Free Preview Lesson

Creating Domain User Accounts Full Access Account Required

Extending the Active Directory Schema Free Preview Lesson

Configure Windows Firewall with Group Policy for SCCM Full Access Account Required

Install SQL Server 2017 Full Access Account Required

Video | 9 min

Installing SCCM Dependent Server Roles Full Access Account Required

Installing System Center Configuration Manager Full Access Account Required

Lab: Installing System Center Configuration Manager Full Access Account Required

Lab | 45 min

Configuration Manager Basics • 1hr 58min

0 / 8 lessons complete

Console Overview Part 1 Full Access Account Required

Console Overview Part 2 Full Access Account Required

Video | 10 min

Site System Roles Full Access Account Required

Creating and Managing Administrative Users Full Access Account Required

Creating Boundary and Boundary Groups Full Access Account Required

Client Discovery Methods Full Access Account Required

SCCM Basics Section Quiz Full Access Account Required

Quiz | 10 min

Lab: SCCM Basics Full Access Account Required

Lab | 60 min

Updating SCCM • 30min

0 / 7 lessons complete

Understanding Windows ADK Compatibility Full Access Account Required

Configuration Manager Update Overview Full Access Account Required

How to Verify Your ADK Version Full Access Account Required

Installing ADK 1903 Full Access Account Required

Updating SCCM Full Access Account Required

Verifying Our Configuration After Update Full Access Account Required

Updating SCCM Section Quiz Full Access Account Required

SCCM Client Installation • 46min

0 / 4 lessons complete

Preparing for Client Installations with Group Policy Free Preview Lesson

Client Push Installation Free Preview Lesson

Video | 11 min

Deploying the SCCM Client with Group Policy Full Access Account Required

Video | 17 min

Manual Client Installation Full Access Account Required

User and Device Collections • 1hr 6min

0 / 13 lessons complete

Collections Overview and the Direct Rule Full Access Account Required

Creating Include/Exclude Collections Free Preview Lesson

Query based User and Device Collections Introduction Full Access Account Required

Query Based User Collections Example #1 Full Access Account Required

Query Based User Collections Example #2 Full Access Account Required

Query Based User Collection Challenge #1 Full Access Account Required

Query Based Device Collection Example #1 Full Access Account Required

Role Based Administration Full Access Account Required

Assigning a User Collection to an Administrative Security Roll Full Access Account Required

Using a Collection to Enforce a Maintenance Window Full Access Account Required

Deploying Power Management to a Collection Full Access Account Required

Using a Collection to Turn-On the Remote Control Feature Full Access Account Required

User and Device Collection Section Quiz Full Access Account Required

Quiz | 5 min

Application Management • 2hr 34min

Application Management Overview Free Preview Lesson

Creating an Application using an MSI Part 1 Full Access Account Required

Creating an Application using an MSI Part 2 Full Access Account Required

Supersedence Part 1 Full Access Account Required

Supersedence Part 2 Full Access Account Required

Creating an Application using an EXE Full Access Account Required

Video | 16 min

Creating an Application that requires Approval Full Access Account Required

Creating a Package using an MSI Full Access Account Required

Uninstalling an Application Free Preview Lesson

Monitoring Applications Full Access Account Required

Lab: Application Deployment Full Access Account Required

Application Management Section Quiz Full Access Account Required

Operating System Deployment • 23min

Create a Windows 10 Collection Full Access Account Required

Text | 2 min

OSD - The Basics Full Access Account Required

Setting Up a DHCP Server Full Access Account Required

Adding an Operating System to Configuration Manager Free Preview Lesson

Create a Deployments folder for the Captured Image Full Access Account Required

Creating a Task Sequence Free Preview Lesson

Enable PXE Support - Configure WDS Full Access Account Required

Endpoint Protection • 1hr 12min

0 / 10 lessons complete

An Overview of Network Security Full Access Account Required

Endpoint Protection Server Prerequisites Full Access Account Required

Endpoint Protection Licensing Full Access Account Required

Video | 1 min

Endpoint Protection Planning and Integration Full Access Account Required

Create a Shared Folder Named EPUdates Full Access Account Required

Endpoint Protection Server Configuration and Installation Full Access Account Required

Endpoint Protection Policy Overview Free Preview Lesson

Video | 13 min

The Anti-malware Policy Settings Overview Full Access Account Required

Configuring an Automatic Deployment Rule (ADR) Full Access Account Required

Endpoint Protection Client Installation Full Access Account Required

Video | 14 min

Troubleshooting • 37min

SCCM Troubleshooting Overview Full Access Account Required

The CMTrace Overview Full Access Account Required

Deploying CMTrace to a Device Collection Full Access Account Required

Troubleshooting a failed Client Push Install Full Access Account Required

Problems and Solutions from the Message Board • 14min

Cannot Establish a Remote Desktop Connection from SSCM to a Client - Alstud Full Access Account Required

Problems Downloading ADK Full Access Account Required

Problems using VB - AKM - Rajib Full Access Account Required

SCCM Console will not connect to the Site Database Full Access Account Required

OSD and Task Sequence Issues Full Access Account Required

Creating Boundary and Boundary Groups

Full-access members only.

Sorry, this lesson is only available to Server Academy Full-Access members. Become a Full-Access member now and get instant access to this and many more premium courses. Click the button below and get instant access now.

Instructions

Resources (0)

Saving Progress...

There are no resources for this lesson.

Notes can be saved and accessed anywhere in the course. They also double as bookmarks so you can quickly review important lesson material.

Characters: 0 / 1000

SCCM boundaries and boundary groups allow you to logically organize your network locations similar to Active Directory Site Services. They define network locations to 

Boundaries  can be defined as an IP subnet, IPv6 prefix, an IP address range or an Active Directory Site.

Boundary Groups  allow you to “group” together multiple boundaries for SCCM client use. Clients will use their current network information (such as subnet, IP or ad site) to identify which boundary groups they belong to.

This is all done in the name of efficiency. If you have SCCM servers in both Georgia and Colorado - you might create a boundary for each state, and a boundary group for each state. Any client that falls within one of these boundary groups will then use the resources available to them in those boundaries.

This is better than the alternative of having a client in Georgia reaching out to an SCCM server in Colorado and vice versa.

In the SCCM console, select Administration > Hierarchy Configuration > Boundaries:

We can create a new boundary by right-clicking and selecting Create Boundary:

I’m going to give it the name Server Academy Boundary. Next under the type I am going to select Active Directory Site so that it uses the same information as Active Directory Sites and Services.

In this particular lab I haven’t done any configuration in ADSS, so I will just have the Default-First-Site-Name site. This could (and probably should) be configured before hand on your domain controller - but ADSS is out of the scope of this lesson so we are just going to go with the first default site.

Once you have entered the information click OK to close the windows.

Now we need to create a boundary group to contain the new boundary we just created. In the navigation window, select Boundary Groups. Right-click in the middle pane and select Create Boundary Group:

Type in a name and optionally a description.

Now click Add and select the boundary we just created then click OK.

Next click the References tab. Click the Use this boundary group for site assignment.. This will assign newly discovered resources to the Assigned Site drop down. Of course, we only have the one which we created when we install SCCM.

Now click Add under Site system servers and select our SASCCM01 server:

Click OK on both of these dialog boxes and now we can see our newly created boundary group:

That’s it! We are done creating the boundary and boundary group.

Server Academy Members Only

Sorry, this lesson is only available to Server Academy Full Access members. Become a Full-Access Member now and you’ll get instant access to all of our courses.

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Set-CMBoundary Group

Modify the properties of a boundary group.

Description

The Set-CMBoundaryGroup cmdlet modifies the properties of a boundary group. A boundary group is a collection of boundaries. For more information, see Define site boundaries and boundary groups and the New-CMBoundary cmdlet.

Run Configuration Manager cmdlets from the Configuration Manager site drive, for example PS XYZ:\> . For more information, see getting started .

Example 1: Rename a boundary group

This command renames a boundary group. It uses the Get-CMBoundaryGroup cmdlet to get the boundary group object, and then passes it using the pipeline operator.

Example 2: Add a security scope to a boundary group

This command adds the security scope OSDeploymentScope to the boundary group BGroup02 .

Example 3: Add a site system server

This command uses the Get-CMSiteSystemServer cmdlet to get a server object, and then adds it to the boundary group.

-AddSiteSystemServer

Specify a site system server object to add to this boundary group. Clients on the boundary group use these servers for policy and content. You can add management points, distribution points, state migration points, software update points, and cloud management gateways. To get a site system server object, use the Get-CMSiteSystemServer cmdlet.

-AddSiteSystemServerName

Specify the fully qualified domain name of a site system server to add to this boundary group. Clients on the boundary group use these servers for policy and content. You can add management points, distribution points, state migration points, software update points, and cloud management gateways.

This parameter requires the fully qualified domain name of the site server.

-AllowPeerDownload

Configure the boundary group option to allow peer downloads in this boundary group. For more information, see Boundary group options for peer downloads .

-ClearSiteSystemServer

Add this parameter to remove all referenced site system servers from the boundary group.

Prompts you for confirmation before running the cmdlet.

-DefaultSiteCode

Specify the site code to set as the assigned site, and enable the boundary group for site assignment.

To disable site assignment for the boundary group, set this value to $null .

-Description

Specify an optional description for this boundary group.

-DisableWildcardHandling

This parameter treats wildcard characters as literal character values. You can't combine it with ForceWildcardHandling .

-ForceWildcardHandling

This parameter processes wildcard characters and may lead to unexpected behavior (not recommended). You can't combine it with DisableWildcardHandling .

Specify the ID of a boundary group to configure. This ID is the GroupID property on the SMS_BoundaryGroup object. For example, 33 .

-InputObject

Specify an object for a boundary group to configure. To get a boundary group object, use the Get-CMBoundaryGroup cmdlet.

Specify the name for a boundary group to configure.

Use this parameter to rename a boundary group.

Returns an object representing the item with which you're working. By default, this cmdlet may not generate any output.

-PreferCloudDPOverDP

Configure the boundary group option to prefer cloud-based sources over on-premises sources. For more information, see Boundary group options for peer downloads .

-PreferDPOverPeer

Configure the boundary group option to prefer distribution points over peers within the same subnet. To enable this setting, also enable -AllowPeerDownload . For more information, see Boundary group options for peer downloads .

-RemoveSiteSystemServer

Specifies a site system server object to remove from the boundary group. To get this object, use the Get-CMSiteSystemServer cmdlet.

To remove all site system servers, use the -ClearSiteSystemServer parameter.

-RemoveSiteSystemServerName

Specifies the name of one or more site system servers to remove from the boundary group. To remove all site system servers, use the -ClearSiteSystemServer parameter.

-SubnetPeerDownloadOnly

Configure the boundary group option to only use peers within the same subnet during peer downloads. To enable this setting, also enable -AllowPeerDownload . For more information, see Boundary group options for peer downloads .

Shows what would happen if the cmdlet runs. The cmdlet doesn't run.

Microsoft.ConfigurationManagement.ManagementProvider.IResultObject

IResultObject

Related Links

• Get-CMBoundaryGroup
• New-CMBoundaryGroup
• Remove-CMBoundaryGroup
• Set-CMSecurityScope
• New-CMBoundary
• Define site boundaries and boundary groups

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback .

Submit and view feedback for

Additional resources