Monday, April 25, 2016

How to audit changes in ConfigMgr 2012 R2 or Current Branch

Sometimes it's needed to audit changes within ConfigMgr 2012 R2 or Current Branch. When changes are made, and you want to know who did some actions, it's good to know that most actions are logged.

Just start the ConfigMgr console, and go to the Monitoring tab. There choose System Status > Status Message Queries. There you will find 41 queries, based on: auditing, boundaries, collections, deployments, packages, programs, remote control activity, security roles, server components and site systems. Lot to find there :-)
Recently it was needed to audit changes, which were found in audit messages. One for the site and for a specific user. Those will tell you who did what and when: 
All Audit Status Messages for a Specific User: Audit status messages that track activity initiated by a specific user (when prompted, use the form DOMAIN\username).  
All Audit Status Messages from a Specific Site: Audit status messages reported at a specific site.
When needed it's good to know that this functionality is built-in the console. Hope it helps!

No comments:

Post a Comment