Static vs. dynamic groups in PDQ

Choosing the right group type can reduce manual device targeting and make software deployments, patching, and remediation workflows easier to automate.

In this article, I’ll explain when to use static groups, when to use dynamic groups, and how each one supports IT automation in PDQ.

What is a static group in PDQ?

A static group in PDQ is a group that’s more or less stationary. You build it, add machines to it, and call it a day. Those machines stay in that group until you make a change manually.

Static groups are great for situations where you don’t expect much to change about the devices.

When to use static groups

Here are a few scenarios where static groups might be the best grouping option in PDQ.

Test deployments

As a sysadmin, you always test your deployments with a small test group or virtual environment before deploying them broadly (... right? RIGHT?!?). Static groups are great for managing those devices.

To accurately represent your full environment, we recommend adding a random mix of computers to your static testing group. For example, say you want to test out your Windows 11 deployment plan with a small group of users in your environment. Add one or two representative devices from each of your departments — Bob's from marketing, Sarah's from accounting, Chloe's from sales — to your static group. Then, deploy your software to those devices. If something breaks, it’s time to troubleshoot. If everything looks good, you can broaden your pool of endpoints to deploy to.

Exclude specific devices from deployments

Static groups can identify devices that should be excluded from certain actions, such as reboots, shutdowns, or software deployments. For example, you might exclude executive devices, production systems, or computers that must remain available outside normal business hours.

Create a static group for those exceptions, then exclude that group from the applicable dynamic deployment target. You can also use a group membership condition on a package or package step when appropriate.

Larry’s computer, which has apparently been running since the Johnson administration, can remain a separate problem.

Make a “holding place" for devices

Ever need a temporary “holding place” for devices during deployments? Static groups come in handy here.

For example, say you need to deploy software to a specific department. You can make a static group, add those devices to it, and then deploy the software. (You know, because accounting doesn’t want the Adobe Suite any more than marketing wants QuickBooks.)

How to create a static group in PDQ

Creating a static group in PDQ is a simple process. Here’s how to do it.

1. From the PDQ console, click Devices.

2. Click Create group.

3. Type in a name for your group in the Name field. Then, click the arrow next to the Type field. Click on Static. The Devices panel will appear.

4. In the Devices panel, select the machines you want to include in your static group. Click the arrow to move them over into the Selected devices column, and then, click Create.

And that’s all there is to it! Now, you have an unchanging group where you can monitor important info about each device.

What is a dynamic group in PDQ?

A dynamic group in PDQ is a group whose membership changes based on certain criteria. You can build out a dynamic group by listing out those criteria — devices with an application, devices without the latest version of a software, etc. — and watch as devices enter and exit the group, depending on whether they meet your set criteria.

Dynamic groups are great if you want an up-to-date view of which devices in your fleet meet certain standards.

When to use dynamic groups

Here are some common use cases for dynamic groups.

Inventory assets

Need to gather up-to-date information about your devices? We built dynamic groups exactly for this.

You can use filters to identify devices that meet certain criteria. For example, using the Software parameter, you can find devices with a specific program installed. Using the Windows updates parameter, you can see which devices haven’t been updated since a certain timeframe. You can even use custom fields to drill down specifics in your environment, depending on how you set up your PDQ instance.

Act on device issues

Dynamic groups can help you act whenever a device meets specific, undesired criteria.

For example, say you want to prioritize cleaning up machines that have less than 20% of free disk space. A dynamic group can show you those devices so that you can take action where needed.

You can create a similar dynamic group that shows the devices with certain vulnerabilities. For example, if you want to target devices with vulnerabilities that have a CVSS score of 7 or greater, a dynamic group can help you see those devices so you can remedy them.

Identify missing applications

Many folks use dynamic groups to see which devices are missing certain applications.

For instance, say you just switched to a new antivirus and want to be sure you deployed it to all your endpoints. You can use a dynamic group to see if any devices in your fleet are missing the new antivirus software. You can even use a dynamic group to identify devices that have your old antivirus software installed so you can remove it easily.

How to create a dynamic group in PDQ

Creating a dynamic group in PDQ is just as simple as making a static group.

1. From the PDQ console, click Devices.

2. Click Create group.

3. Type in a name for your group in the Name field. Then, click the arrow next to the Type field. Click on Dynamic. The Devices panel will appear (heads up — it looks different from the Devices panel for static groups).

4. In the Devices panel, set up the parameters you want to use to filter devices. In this example, let’s say we want to create a dynamic group of machines that do not have Firefox installed. Here’s what those parameters would look like:

5. Click Create. 

That’s it! We can see all the devices in our network that don’t have Firefox installed.

But just for fun, let’s take this a step further. What if we want to deploy Firefox to those devices where it’s missing?

With our dynamic group, it’s a piece of cake.

1. From the dynamic group we just created, select the checkbox at the top to select all devices in the group. Then, click Deploy.

2. In the Create deployment dialog box, type Firefox in the Search packages field. Click on the Mozilla Firefox package. Then, click Deploy.

Once the PDQ agent scans those devices, we’ll be left with a lonely, empty group because these machines now have Firefox installed.

Automating patching and deployments with PDQ

PDQ brings inventory, dynamic targeting, software deployment, and patch automation into the same cloud console. The agent regularly scans managed devices, dynamic groups identify machines that meet your criteria, and automations deploy packages to those groups automatically or on a recurring schedule.

For example, you can create dynamic groups for devices that:

• Are missing a required application

• Have an outdated application installed

• Are missing a Windows cumulative update

• Have a vulnerability that exceeds your organization’s risk threshold

• Belong to a specific test, pilot, or production group

You can then target those groups with an Automation. An automatic trigger runs when a new version of a selected Package Library package becomes available, while a recurring trigger runs on the daily, weekly, or monthly schedule you configure.

For a staged rollout, use separate groups for each deployment phase:

1. Test: Deploy the package to a small static group of representative IT devices.

2. Pilot: Deploy it to a broader group of users and device configurations after testing succeeds.

3. Broad: Target the applicable production group once the pilot results look good.

Static groups keep each rollout ring predictable. Dynamic groups keep the final production target current by automatically adding devices that need the update and removing devices after their inventory data shows that they are compliant.

Example: Automate a critical update deployment

Here’s one way to turn missing-update inventory into a repeatable deployment workflow:

1. Create the target group. Build a dynamic group that identifies devices missing the applicable Windows cumulative update or devices affected by the vulnerability you need to remediate.

2. Test the update. Deploy the update package to a small static test group and review the deployment results before expanding the target.

3. Automate the broader rollout. Create an automation for the approved package, select the dynamic group as the target, and configure an automatic or recurring trigger based on your patching policy.

As updated devices are rescanned, they stop matching the missing-update criteria and leave the dynamic group automatically.

Small-team workflow for two IT admins

A two-person IT team can divide patching and deployment work without maintaining every target manually.

Admin 1: Inventory and targeting

• Monitor vulnerability, Windows update, and deployment results.

• Maintain dynamic groups for missing applications, outdated software, missing updates, and high-priority vulnerabilities.

• Review exceptions and devices that remain in remediation groups after a deployment.

Admin 2: Packaging and deployments

• Maintain the test and pilot groups.

• Validate new or updated packages against the test group.

• Create or approve automations for recurring application updates and scheduled production deployments.

• Investigate failed deployments and devices that were offline during the rollout.

A practical cadence might include reviewing critical vulnerabilities and failed deployments each day, testing newly updated packages during the week, and running broader recurring deployments during an approved maintenance window. Because PDQ performs inventory scans automatically, the team can focus on exceptions and deployment results instead of launching routine scans manually.