Tips about ConfigMgr Audit Reports understanding who Deleted ConfigMgr Task Sequence. Let’s see how you can find the who created, modified, deleted the configuration manager packages, and Task Sequences.
More details about six status message queries are listed under the Administrative Security category. I have uploaded a YouTube video here to explain the process of audit reporting.
Related Post – Who Deleted Updated Modified SCCM Collection
TL;DR
Who Created ConfigMgr Task Sequence
Use SQL Management studio to understand who created ConfigMgr Task Sequence.
/* Who Created the Package Properties of a Task Sequence*/ select * from vStatusMessagesWithStrings where MessageID = 30000
Who Modified SCCM Task Sequence
Use SQL Management studio to understand who modified ConfigMgr Task Sequence.
/* Who modified the Package Properties of a Task Sequence*/ select * from vStatusMessagesWithStrings where MessageID = 30001
Who Deleted ConfigMgr Task Sequence
Use SQL Management studio to understand who deleted ConfigMgr Task Sequence.
/* 'Who deleted the Task Sequence'*/ select * from vStatusMessagesWithStrings where MessageID = 30002
HTMD Forum Question
Let’s one of the real-world examples of the use of SCCM audit reports from the HTMD forum. More details https://forum.howtomanagedevices.com/endpointmanager/configuration-manager/sccm-audit-logs/