MECM/SCCM - Collection Query

[CHiLL]

I have a bit of an odd request when it comes to a collection I want to deploy to. We have our VPN profile pushed as an app (a PowerShell script that add the profile with a configuration XML defined). This has worked fine for the couple of years we've had it in place. However, it's pushed to a machine collection (staff laptops) and installed as System, which adds it into the logged on user's profile. Because it's pushed to a machine collection, it only runs once. If another user logs on, it won't re-run. I have changed the deployment type to push it to our user collection (All Staff) and install as the user. At the moment, I've only made it "Available", as I don't want it to push everywhere (which is would if set to "Required").

 

Ideally, I'd like to push this VPN profile to all staff users, but only when they're logged onto their laptops. I'm not sure how I can go about achieving this. The closest thing I can seem to find is setting the Requirements to the device must be in our Laptops OU. I've only just specified this Requirement, so I need to wait to test it.

 

Is that the best option, or is there a potentially better solution?

[clareq]

You could use a WMI query to only install to devices with batteries (only laptops have batteries!), just in case you ever have a reason to put a laptop in a different OU:

SELECT * FROM Win32_Battery WHERE (BatteryStatus <> 0)