Share via

SCCM Collection Performance: AD Groups and OUs vs. Native Queries

Lysa Analyst 0 Reputation points
2026-04-06T13:27:34.6066667+00:00

I'm currently designing the architecture for our massive company merger, and the senior engineer wants to use Active Directory OUs and security groups to handle our daily application deployments. He keeps insisting that relying on AD structures for operational tasks in SCCM is a massive performance killer and totally inefficient. Is it really that bad to build device collections that sync based on standard AD attributes? I'm trying to nail down the absolute best practice before I present the final blueprint. Does constantly polling the domain controllers for this data actually cause a noticeable drag on collection evaluation cycles compaired to just using native WQL queries?

Windows for business | Windows Server | Devices and deployment | Configure application groups
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Harry Phan 17,745 Reputation points Independent Advisor
    2026-04-06T14:11:51.5666667+00:00

    Hi Lysa,

    It’s not inherently a performance killer to base SCCM collections on AD OUs or security groups, but it’s not considered best practice for large environments. The collection evaluator in SCCM doesn’t constantly poll domain controllers; it queries AD during scheduled discovery cycles, and then evaluates membership based on that data. The real drag comes when you have hundreds of collections tied to dynamic AD queries with frequent incremental updates, this can extend evaluation cycles and delay deployments. Native WQL queries against SCCM’s own SQL database are faster because they avoid the dependency on external AD lookups and rely on data already in the site database. Microsoft’s guidance is to use AD discovery only to bring in resource data, then build collections using attributes stored in SCCM itself.

    For a merger-scale architecture, you’ll want to minimize reliance on AD structures for operational targeting and instead design collections around SCCM-native queries, which scale better and reduce evaluation overhead.

    I hope the information is helpful to you. If it is, please accept the answer, or give it a thump up to let me know. Have a nice day!

    Harry.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.