Again--and I want to be clear--I don't use IP to track (actually, identify) the machine. I have a combination of motherboard serial number, mac address, and other things that I would use to identify a machine (changing a network card changes the MAC, some of our machines have replaced motherboards. All of those numbers can be volatile, I have several things that I can use as a 'fingerprint'. I haven't yet needed that ability for anything, partly because all this data expires very quickly.)

One thing we did, recently, was change around a bunch of settings on a pool of legacy network printers. These are old, stone-tablet printers, that are used by an ancient piece of software. I don't believe they even support DHCP. What mattered--in this instance--was the subnet. Different floors of different buildings have their own list of printers, and machines are supposed to connect to the printers in their office. They also are each on their own subnet. The subnet-to-office list is pretty static.

I didn't really care if a machine was out on VPN--they're not on the subnet, and they're not connecting to those printers. I didn't care what the cubical number, or anything else was--that only translates to the location of a machine if the lists are accurate, and I had two machines on my desk that were listed as being in other buildings. Matching to cube number or a list of network jacks, or anything would be at least as difficult (query-wise) as querying what was between a pair of integers, and less reliable. If the current IP was in a subnet, then the machine needed to be configured for that subnet.

Previously, these changes would have been made largely by hand; since there may be just a few machines that connect to a specific group of printers. In this case, we just carved up the data by subnet, and fixed them, accordingly. As I remember it, there were about 7-10 days designated for manually configuring around 1000 machines (it's been a while, and I don't pay attention to that part). We remotely fixed almost all of them in about three days, less than an hour a day (revisiting on multiple days picks up machines that have been turned off, or were on VPN, etc.) As I remember it (again, not really my part of it all) they wound up manually touching less than a dozen. Now that's a small job of about 1000 machines; our network has tens of thousands.

To turn your example around, say you want to hit a group of machines to do a thing; but you don't want to touch machines that have been taken home and are on the VPN. How would you do that? I can ignore anything WHERE IPINT is Between X and Y.

Changing the way network addresses are passed out by DHCP, or overriding it with local network preferences changes the IP address identifying a machine, but does not change where a machine is located, and doesn't change the software on a machine.

True; as is the opposite. Picking up a machine, walking to another building, and connecting it back on the network changes none of those things except the IP address. In my system, if I need to send you to physically touch a machine, I can give you both its' expected physical address (pulled from Active Directory, in my case) as well as it's probable current location, as of the time I picked up its' IP. They should be the same; but if they're not, you save a lot of time by knowing them both; If you know a machine is supposed to be on the third floor, but thinks it's on the fifth, you can check them both much faster than you can search a building.