Tips about ConfigMgr Audit Reports understanding who Deleted ConfigMgr Task Sequence. Let’s see how you can find the who created, modified, and deleted the configuration manager packages, and Task Sequences.
More details about six status message queries are listed under the Administrative Security category. I have uploaded a YouTube video here to explain the process of audit reporting.
Related Post – Who Deleted Updated Modified SCCM Collection
Who Created ConfigMgr Task Sequence
Use SQL Management studio to understand who created ConfigMgr Task Sequence.
/* Who Created the Package Properties of a Task Sequence*/ select * from vStatusMessagesWithStrings where MessageID = 30000
Who Modified SCCM Task Sequence
Use SQL Management studio to understand who modified ConfigMgr Task Sequence.
/* Who modified the Package Properties of a Task Sequence*/ select * from vStatusMessagesWithStrings where MessageID = 30001
Who Deleted ConfigMgr Task Sequence
Use SQL Management studio to understand who deleted ConfigMgr Task Sequence.
/* 'Who deleted the Task Sequence'*/ select * from vStatusMessagesWithStrings where MessageID = 30002
HTMD Forum Question
Let’s be one of the real-world examples of the use of SCCM audit reports from the HTMD forum. More details https://forum.howtomanagedevices.com/endpointmanager/configuration-manager/sccm-audit-logs/
Resources
Author
Anoop C Nair is Microsoft MVP! He is a Device Management Admin with more than 20 years of experience (calculation done in 2021) in IT. He is Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc.