There are certain times when we need information about what SCCM Admin / user has made changes in last couple of hours / days. Today I am going to show you how easily you can fetch this information within SCCM console. We can get audit all the activities for a specific user against creating/modifying/deleting any package/task sequence, any SCCM related activity such as creation/deletion of boundary groups, SCCM client agent settings, reports,compliance. It could be anything, hence this is very handy in case we need to find out what specific user did and on which date.
Launch SCCM console and navigate to “\Monitoring\Overview\System Status\Status Message Queries“
Under right pane search for “All Audit Status Messages for a Specific User“, right click and select “Show Messages”
This will popup a window asking for “Property Value” and “Time“. Select “Property Value” and provide username in following format Domain\Username:
Now click on time, and select from list of pre-exists from drop down menu such as hours, days, weeks, months etc:
I have selected 1 month, make sure both “Property Value” and “Time” value has been filled.
Click on ok to display complete user of specific user activity for last 6 months including edition,deletion, creation etc anything related to SCCM activity under “Configuration Manager Status Message Viewer”.