SCCM Configmgr 2012 way to find Who Created modified Deleted the collection using SSRS Reports

Quick Post: There was a question on TechNet forum asking,about who created the collection ,More read http://social.technet.microsoft.com/Forums/en-US/e5ea645e-84ec-49ce-82f5-e5d92b0f49a5/details-on-sccm-collection-creation?forum=configmanagergeneral

I have seen few cases in Configmgr 2007 and less in Configmgr 2012 due to RBA ,that Configmgr guys will try to do something on collection but it ends at something that causes the resources to disappear from Configmgr database and later you know the consequences from top management. The easiest way to get the resources into Configmgr is,to run the discovery.

Recently peter posted a blog about Who created that deployment and who deleted that deployment but these posts mainly focus on the deployment part using Reports.

Through this post,i will provide you the information about collections like who created,who Modified ,who deleted and who deleted resources from the collection etc using Reports.

Unlike Configmgr 2007 ,Configmgr 2012 also have few ways to get the information about this 1) using Status messages queries 2 ) Default reports 3) Using SQL queries

I always prefer to use the Default report in Configmgr called ‘All messages for a specific message ID’ under status messages folder from your Configmgr SSRS reports folder to know who created ,deleted as other 2 methods are little complicated to search for the required information(compared to reports) and to write SQL queries.

So coming to the subject,you can run the default report but you need to know the description of the status message ID what you are looking for.

You can use below status message ID’s to know who did what on collections.

 

Message ID

                                                             Description

30015

User "<>" created a collection named "Coll Name" (CollID)

30016

User "<>" modified the Collection Properties for a collection named "Coll Name" (CollID)

30017

User "<>" deleted a collection named "Coll Name" (CollID)

30067

User "<>" deleted all of the resources that belong to collection "Coll Name" (CollID)

30104

User "<>" requested that the membership be refreshed for collection "Coll Name" (CollID)

30107

User "<>" requested that the CCRs be generated for collection "Coll Name" (CollID)

30066

User "<>" deleted a discovered resource named "ComputerName" ResourceID

 

Report Results for Who deleted what Collections ?

image

If you are looking for information about Configmgr 2007,refer this post http://blogs.technet.com/b/configurationmgr/archive/2013/10/01/how-to-determine-who-deleted-what-objects-in-the-configuration-manager-console.aspx

Hope it helps.

7 Responses to "SCCM Configmgr 2012 way to find Who Created modified Deleted the collection using SSRS Reports"

  1. 300016 - User "" modified the Collection Properties for a collection named "Coll Name" (CollID)
    300017 - User "" deleted a collection named "Coll Name" (CollID)
    300067 - User "" deleted all of the resources that belong to collection "Coll Name" (CollID)

    Message ID's are 30016, 30017, 30067.. Please update it

    Reply
  2. Hi Eswar,

    I want to run a script for given condition, please help me...........

    I deployed sccm 2012 client using group policy, it should run in end user machine, if the client is not present or if the client version is lower than present version.

    Thanks in advance
    Saritha

    Reply

Post Comment