Skip to main content


Working with management groups and the Tachyon PowerShell Toolkit

How to work with management groups using the Tachyon PowerShell Toolkit.

About Management Groups

Management groups provide a powerful mechanism for cleanly partitioning and classifying devices within an estate. Management groups are associated with one or more rules (not to be confused with Tachyon's Guaranteed State rules) which define the criteria for group membership. For example, you could define a management group whose membership rule was that all devices whose fqdn contained a particular string would be members of the group.


Tachyon version 8 has introduced changes to the way management groups work. Although in most cases the broad concepts are similar, there are some important differences. Please refer to Management group changes in Tachyon v8 for a summary of changes.

Management groups and the SLA subsystem

Tachyon relies on the SLA subsystem for management group functionality. While versions prior to release 8 of Tachyon could be configured to be independent of SLA, this functionality is now deprecated. However, Tachyon keeps information on management groups internally and requires synchronisation with the SLA subsystem in order to reconcile the SLA management groups with its internal set of groups.

Internally, Tachyon associates a simple set of device FQDNs with a management group. The SLA subsystem is responsible for dynamically evaluating the rules associated with its management groups and then updating this device list on the Tachyon side. Devices which are matched by the rules are included in the list and devices which fail to match are excluded.


Tachyon v8 introduced Direct-based management groups. These allows management groups to defined by one or more FQDNs which make up the group membership, rather than a set of dynamic matching rules. This facilitates the synchronisation of large device collections from external sources such as Microsoft Endpoint Configuration Manager.For more information about them, please refer to Direct-based management groups.

The PowerShell Toolkit has a set of cmdlets to create and update SLA management groups and to manage the synchronisation of SLA management groups with Tachyon. For more information, please refer to Instruction management cmdlets.

Getting started with management groups

After installation, Tachyon does not contain any pre-defined management groups.

For versions from Tachyon v8 onwards, you can follow the simple test scenario documented in the section below 'Understanding SLA Management Groups - a simple test scenario' to create and verify groups using the Tachyon PowerShell Integration Toolkit cmdlets.


If you have issues running the connector sync during the above process, and these indicate licensing issues with the 1E-Inventory-* instructions, ensure that your Tachyon license has a valid entry under the TachyonExplorer section which associates the 1E-Inventory prefix with a valid signer hash. If you are unsure of the correct value for this, you can use the export-instruction cmdlet to retrieve one of the inventory instructions, open it in TIMS and inspect its code signing certificate. The thumbprint value of that certificate is the hash required in the license entry. In the example below, the 1E-Inventory prefix is included in the TachyonExplorer feature along with the inventory consumer and specifies a certificate thumbprint beginning E9AD.... which corresponds to the certificate used to sign the 1E-Inventory instructions distributed with this version of Tachyon.

Note that these thumbprint values may change across releases if new certificates are used, so you should check their validity in the event of problems, by loading the instruction into TIMS and cross-referencing with the actual signing certificate thumbprint, as discussed above.

 <Feature name="TachyonExplorer">
        <Consumer name="Platform" enable="on"> </Consumer>
        <Consumer name="Explorer" enable="on"> </Consumer>
        <Consumer name="Syslog" enable="on"> </Consumer>
        <Consumer name="Experience" enable="on"> </Consumer>
        <Consumer name="PatchSuccess" enable="on"> </Consumer>
        <Consumer name="GuaranteedState" enable="on"> </Consumer>
        <Consumer name="Inventory" enable="on"> </Consumer>
        <Instructions signersha="F08386A5318A8187D79B0A58253C65CB4E442570" pattern="1E-Explorer-*"> </Instructions>
        <Instructions signersha="323048C57C2A82DF852E1BC9AAA2DC2793E3D2B1" pattern="1E-Exchange-*"> </Instructions>
        <Instructions signersha="E9AD8EA04811AF7D0CF827AC015183481D78358D" pattern="1E-Explorer-*"> </Instructions>
        <Instructions signersha="A2837DBA33FBF3C29B7E72156729D1339A636344" pattern="1E-Exchange-*"> </Instructions>
        <Instructions signersha="E9AD8EA04811AF7D0CF827AC015183481D78358D" pattern="1E-Inventory-*"> </Instructions>
Creating a management group from the Settings UI

You create a management group from the Tachyon Settings application, by selecting Permissions/Management Groups.

For example, you can create a group which is associated with all processors having 2 cores.


It appears to be necessary to check the 'evaluate rules immediately' option when saving the group for it to become visible via the Tachyon API and thus useable by the PowerShell Integration Toolkit

Verifying a management group

You can use the 'get-Tachyonrespondingdevice' cmdlet to determine which devices would be associated with a management group at any point in time. To do this, first use the 'get-Tachyonmanagementgroup' cmdlet to list management groups and determine the 'usableid' property of the group you wish to interrogate.

For example:


If we wanted to determine which devices are associated with a management group we can then interrogate group membership like this.

Note that the UsableId property of the group above is 6, so we specify that in the target scope expression

Management groups and SLA

Tachyon can synchronise its internal management groups with SLA management groups. SLA management groups define device membership by a set of rules which specify device attributes such as full or partial OU path etc.

When Tachyon synchronises with SLA, it retains a list of the devices that matched the SLA management group rules, that were also in the associated SLA repository at the time of synchronisation. From this point, Tachyon uses that device list as the group membership until such time as the group is re-synchronised from SLA.

SLA management groups are created and managed using the Tachyon settings application. You can also create SLA management groups using the PowerShell Integration Toolkit.

You can view SLA management groups using the get-tachyonmanagementgroup cmdlet and specifying the optional -Source argument as SLA

When you do this, management group information is retrieved via the SLA API rather than directly from Tachyon itself.

You can also view SLA management groups using the get-tachyonslamanagementgroup cmdlet, which returns only SLA management groups. This cmdlet has the additional option of returning the rules associated with an SLA management group

Note that SLA management group properties are in some cases different from Tachyon management group properties, as you can see from the example below.


Starting with version 8 of Tachyon, there are additional cmdlets to manage SLA management groups. These are discussed in the cmdlet reference page Instruction management cmdlets.

Collecting inventory via SLA

In order to test management group functionality, we need to perform an inventory collection sync, as follows.

Create a Tachyon connector

On the connectors screen create a new connector called Tachyon. Associate it with the Inventory repository and point it at the appropriate consumer URL on your Tachyon server. In this example the Tachyon server is tachyonv8.urth.local

Ensure that the account that the connector runs under is an account granted the Global Administrator role - in this test lab, this corresponds to the CISO account - and enter the account password.

Save the connector.


Select the connector and press Execute.

Enter the details into the following screen as shown below.


Press Execute. You can view the progress of the sync from Monitoring/Process Log in the UI.

Once the sync is complete, we can experiment with management groups.

Verify devices have been captured

If you use a target scope of 'urth' which is a shortcut for 'fqdn like %urth%' as a Tachyon scope expression, you should find both devices returned

Create a test management group

Now let's create an SLA management group that filters this device set.

We will use a rule which matches device Fqdns that are like "%dev%". This will only return one of the two devices.


The square brackets around the entity names are not required unless any part of the name has embedded spaces. You could for example, just say "ReportDevice.Fqdn like %dev".



Please refer to SLA management groups and rule expressions for a discussion of SLA management group rule expressions and the entities that you can use with them. Note that SLA entity names will be different from Tachyon entity names. The attribute part of the names (in this example Fqdn) are also case-sensitive.

Synchronise the group with Tachyon

In order for Tachyon to use the group we just created, we need to synchronise Tachyon with SLA.


Although we are only dealing with a single management group here, when you synchronise a particular group, you will also cause any other newly-created groups to be synchronised with Tachyon and any deleted groups will be removed.

However, only the specified group is updated, so any other groups in SLA which have been changed don't get re-synchronised unless you specify them individually in calls to Sync-TachyonSLAManagementGroup

Also. newly-created groups in Tachyon must be specifically synchronised (by specifying their Id in the Sync-TachyonSLAManagementGroup cmdlet) in order for the actual device membership associated with the group to be updated. Until this is done, the group in Tachyon will appear to contain no devices.


To obtain the repository Id value, we can query for all SLA repositories, and locate the Default Inventory repository. It is the Id of this repository which we then provide to the sync-TachyonSLAManagementGroup cmdlet.


Now verify that Tachyon has the new management group.



The management group in Tachyon may end up with a different Id. Its UsableId value is what we will use when querying in Tachyon.

If you delete a management group in SLA, it remains visible in Tachyon until you perform a sync operation for another existing SLA management group. At this point, the group is also deleted from Tachyon.

Determine the devices which fall into the scope of the management group.



If you don't get any devices, try executing a sync again from the Tachyon Platform UI but select 'generate report - basic inventory consolidation' instead of 'Sync Data - Tachyon'. Then try running the sync-tachyonslamangementgroup cmdlet again and re-check

You can now experiment by modifying the existing group or creating a new one. For example, suppose we change the existing group in SLA.


We re-synchronise


Wait about a minute for the sync to complete. Now when we re-evaluate the rule, we see that the filtered devices have changed accordingly.

Direct-based management groups

Using the PowerShell Toolkit to create and update Direct-based management groups.

These management groups are distinct from Rule-based management groups, which are discussed on the parent page to this.

Direct-based management groups allow you to specify a list of specific device FQDNs which are to belong to a management group.

Creating or updating a Direct-based management group

Direct-based management groups are managed a little differently than Rule-based groups. This reflects that the underlying APIs to manage them are also different.

You create or update a Direct-based management group using the Set-TachyonSLADirectManagementGroup cmdlet. You specify the name of the group and optionally its description. You also pass in an array of one or more FQDNs which correspond to the devices which are to be members of the group.



Unlike Rule-based management groups, calling this cmdlet will immediately cause a synchronization operation to occur between SLA and Tachyon, updating or adding any management groups to Tachyon during this process. Note that the synchronization process will add any other management groups that were created, including Rule-based groups, and it will delete any groups that have been deleted from SLA.

After the synchronization process is complete, you can then use the management group in a Tachyon scope expression just like a Rule-based group.

If the synchronization process added new groups to Tachyon, you must explicitly synchronize these with the Sync-TachyonSLAManagementGroup cmdlet to cause their device membership to be updated. Until this is done, these new groups will appear to be empty.

You can retrieve the group membership of a Direct-based management group using the Get-TachyonSLAManagementGroupDevice cmdlet