Currently the best method to control what devices are targeted in a task it to set the query up to resolve machines and not users. That way when the query resolves it only pulls in those machines, and not all machines that a user has logged into.
Let me know if you have more questions.
I agree with Bryce. My preferred approach to for those that like to use AD as a targeting mechanism is to have machines accounts added to a distribution group rather than user accounts. This keeps the ability for the service desk to subscribe users without the need to be able to access the LD management console; you just need to make sure they have the rights to control membership.
This is also a potential for the use of the uninstall association where the application gets removed if the device is no longer a target. This helps you to subscribe/unsubscribe devices.
MarXtar Ltd/MarXtar Corporation
LANDESK One Development Partner
The One-Stop Shop for LANDESK Enhancements