I see several possibilities. The systems that are waiting for deployment should have distinguishing tag, whereas every other "normal" systems should have no special tags.
If there is a distinguishing property of the systems put to storage that would signal that they are waiting to be deployed (for example they might have been created from image and the image prepares the computers with a special name (or with a name convention)) or other, then this could be the basis for the special tag.)
Another possibility is that you frequently run a server task that deletes inactive systems. Systems put to storage will be off the network (I hope) so they would be deleted by this task. Systems not updating properly are checking in regularly (expected to) so they remain in the queries. Systems having agent problems will be detected by RSD (and thus fixed sooner or later) and might be included in query results.
Included in the results are machines which were built, but set aside waiting to be deployed.
Do these machines have an agent installed, or are they just being pulled in to ePO by the sync task? If they don't have an agent yet then they will have a status of Unmanaged, which you should be able to filter on...
These machines will have the agent installed. The process has been, when the techs image a machine, they install everything so it's ready to go when needed. The computers will call home and update during that build process, but then the machines are shut down, and put back in storage.
What Attila suggested about the naming convention would work, but as of now, when a machine is imaged, it gets named according to our standard convention. We don't really have a generic description to give them, but that may be something we look at.
Looking at the given fields when creating a new tag, I didn't see anything else I could use to distinguish these particular machines.
Not sure if this will help you but I'm starting to play around with some PowerShell scripts and using the ePOwerShell tool from the Tool Exchange (https://community.mcafee.com/docs/DOC-4297). Maybe you can add something to your imaging process that will apply the tags via PowerShell? Or, maybe those systems can be staged in a different OU within your Active Directory and a scheduled task could run to apply the ePO tags to systems in that OU. Then, once they are moved out of that OU and put into production, the same scheduled task could remove the tag?
Since I'm also an AD admin and a big scripting fan, I like the added flexibility of the ePOwerShell tool. I can use it to apply tags based on an almost limitless set of criteria.
After looking at the setup more, I think I'm going to have an additional group created in AD to place these computers, and I can filter them that way. Some of the computers may sit for months before being deployed, so I would rather not have them in my systems tree until necessary.
Thanks for all the replies!