SCCM

Who Modified ConfigMgr Task Sequence – Status Message Queries

Did you ever wonder who modified ConfigMgr task sequence without any prior notice ?. ConfigMgr allows you to find out who created, modified, deleted the configuration manager packages, and Task Sequence. Using the status message queries, we will find out who modified the ConfigMgr Task Sequence.

In my previous post I covered the steps to find out who deleted the SCCM task sequence. You may refer that post when someone accidentally deletes the task sequence and you want to find out who did that.

Status Message Queries are one of the underappreciated features of ConfigMgr. The information you can gather in a quick and easy query will help you to determine the root cause analysis of an issue.

You can use status message queries to identify when a specific component, operation, or Configuration Manager object was modified or deleted, and the account that was used to make the modification. You can use it find who modified ConfigMgr task sequence

In a separate post I will be publishing all the audit status message ID’s so that you can use them when required.

Find Who Modified ConfigMgr Task Sequence

Let’s find out who modified the ConfigMgr Task Sequence using status message queries. When I say modified a task sequence, it includes two things.

  • User who Created the package properties of the task sequence.
  • User who Modified the package properties of the task sequence.

Find who Created the Package Properties of a Task Sequence

In this step we will find the user who created the package properties of the task sequence.

  • Launch the SQL Server Management studio and login.
  • Expand Databases and right click your ConfigMgr database and click New Query.
  • Enter the below query to find the user who created the package properties of SCCM task sequence.
/* Find the user who Created the Package Properties of a Task Sequence */
select * from vStatusMessagesWithStrings where MessageID = 30000

When you run the above query, in the query output, take a look at InsStrValue1, InsStrValue2, InsStrValue3 values.

  • InsStrValue1 – The user account who created the package properties in the task sequence.
  • InsStrValue2 – The package ID.
  • Time – The date and time when the task sequence was deleted.
  • InsStrValue3 – The actual name of the package.
Track the user who Created the Package Properties of a Task Sequence
Track the user who Created the Package Properties of a Task Sequence

Find Who Modified the Package Properties of a Task Sequence

In this step we will find the user who modified the package properties of the task sequence.

  • Launch the SQL Server Management studio and login.
  • Expand Databases and right click your ConfigMgr database and click New Query.
  • Enter the below query to find user who modified the package properties of SCCM task sequence.
/* Find Who modified the Package Properties of a Task Sequence */
select * from vStatusMessagesWithStrings where MessageID = 30001

When you run the above query, in the query result, take a look at InsStrValue1, InsStrValue2, InsStrValue3 values.

  • InsStrValue1 – The user account who modified the package properties in the task sequence.
  • InsStrValue2 – The package ID.
  • Time – The date and time when the task sequence was deleted.
  • InsStrValue3 – The actual name of the package.
Find Who Modified ConfigMgr Task Sequence
Find Who Modified ConfigMgr Task Sequence

Who Modified SCCM Task Sequence – Status Message Viewer

In addition to above methods, you can use the SCCM status message viewer tool to find who modified the ConfigMgr task sequence. If you don’t want to run query against the database you can always use the Configuration Manager status message viewer tool.

  • First of all, launch the Configuration Manager console.
  • Go to Monitoring\Overview\System Status\Status Message Queries.
  • Right click All Status Messages and click Show Messages.
  • Use the filter option and enter the message ID as 30001 and click OK.
  • The Audit message description with Message ID 30001 should tell you who modified the task sequence.
Find Who Modified ConfigMgr Task Sequence
Find Who Modified ConfigMgr Task Sequence

Prajwal Desai

Hi, I am Prajwal Desai. For last few years I have been working on multiple technologies such as SCCM / Configuration Manager, Intune, Azure, Security etc. I created this site so that I can share valuable information with everyone.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button