Quick Post: There was a question on TechNet forum asking,about who created the collection ,More read http://social.technet.microsoft.com/Forums/en-US/e5ea645e-84ec-49ce-82f5-e5d92b0f49a5/details-on-sccm-collection-creation?forum=configmanagergeneral
I have seen few cases in Configmgr 2007 and less in Configmgr 2012 due to RBA ,that Configmgr guys will try to do something on collection but it ends at something that causes the resources to disappear from Configmgr database and later you know the consequences from top management. The easiest way to get the resources into Configmgr is,to run the discovery.
Recently peter posted a blog about Who created that deployment and who deleted that deployment but these posts mainly focus on the deployment part using Reports.
Through this post,i will provide you the information about collections like who created,who Modified ,who deleted and who deleted resources from the collection etc using Reports.
Unlike Configmgr 2007 ,Configmgr 2012 also have few ways to get the information about this 1) using Status messages queries 2 ) Default reports 3) Using SQL queries
I always prefer to use the Default report in Configmgr called ‘All messages for a specific message ID’ under status messages folder from your Configmgr SSRS reports folder to know who created ,deleted as other 2 methods are little complicated to search for the required information(compared to reports) and to write SQL queries.
So coming to the subject,you can run the default report but you need to know the description of the status message ID what you are looking for.
You can use below status message ID’s to know who did what on collections.
Message ID |
Description |
30015 |
User "<>" created a collection named "Coll Name" (CollID) |
30016 |
User "<>" modified the Collection Properties for a collection named "Coll Name" (CollID) |
30017 |
User "<>" deleted a collection named "Coll Name" (CollID) |
30067 |
User "<>" deleted all of the resources that belong to collection "Coll Name" (CollID) |
30104 |
User "<>" requested that the membership be refreshed for collection "Coll Name" (CollID) |
30107 |
User "<>" requested that the CCRs be generated for collection "Coll Name" (CollID) |
30066 |
User "<>" deleted a discovered resource named "ComputerName" ResourceID |
Report Results for Who deleted what Collections ?
If you are looking for information about Configmgr 2007,refer this post http://blogs.technet.com/b/configurationmgr/archive/2013/10/01/how-to-determine-who-deleted-what-objects-in-the-configuration-manager-console.aspx
Hope it helps.
7 Comments
Hello,
Is there a trace of old-new / before-after record in case of modification?
Thanks,
Dom
300016 - User "" modified the Collection Properties for a collection named "Coll Name" (CollID)
300017 - User "" deleted a collection named "Coll Name" (CollID)
300067 - User "" deleted all of the resources that belong to collection "Coll Name" (CollID)
Message ID's are 30016, 30017, 30067.. Please update it
Hi Mohan,
thanks for pointing out the extra 0 ,appreciate it. I have updated the post now.
Regards,
Eswar
Thanks for your chart however you have a typo in the first entry id, 30015 should be 300015.
Hi,
I see it is 30015 and is correct.Where do you see 300015 ? did you get any results with 300015 ?
Regards,
Eswar
Hi Eswar,
I want to run a script for given condition, please help me...........
I deployed sccm 2012 client using group policy, it should run in end user machine, if the client is not present or if the client version is lower than present version.
Thanks in advance
Saritha
i would recommended to use /look at Jason sandys client start-up script ,it really works good http://blog.configmgrftw.com/configmgr-client-startup-script/