If you are looking to dynamically filter a device collection so that only machines with the IIS role enabled are included try using the query below.
select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_SERVICE on SMS_G_System_SERVICE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SERVICE.Name = “W3SVC”
Don’t forget you can either limit this device collection to another or create another and limit it to this collection to filter further – e.g. Windows 2012 servers with IIS installed.