Prajwal Desai

SCCM | ConfigMgr | Intune | Windows 11 | Azure

  • Home
  • Cloud
    • Autopilot
    • Azure
    • Endpoint Analytics
    • Intune
    • PowerShell
    • Teams
    • Windows 365
  • Microsoft
    • Active Directory
    • Group Policy
    • SCCM
    • SCOM
    • Windows 10
    • Windows 11
    • Windows Server
    • WSUS
  • Software
  • Forums
  • Newsletter
  • Contact
Notification Show More
Latest News
Fix Windows Autopilot Reset Error 0x80070032
Fix Windows Autopilot Reset Error 0x80070032
Autopilot Intune
Windows activation error 0xc004c020
Fix: Windows Activation Error 0xC004C020 with 2 Easy Methods
Windows 11 Windows 10
Find the Package ID of SCCM Application
3 Best Ways to Find the Package ID of SCCM Application
SCCM
SCCM Updates Install Error 0x800b0109 0x8024b303
Fix: SCCM Updates Install Error 0x800b0109 | 0x8024b303
SCCM
Disable Windows Hello for Business using Intune ftimg
Disable Windows Hello for Business using Intune – Comprehensive Guide
Intune Autopilot
Aa

Prajwal Desai

SCCM | ConfigMgr | Intune | Windows 11 | Azure

Aa
Search
  • Home
  • Cloud
    • Autopilot
    • Azure
    • Endpoint Analytics
    • Intune
    • PowerShell
    • Teams
    • Windows 365
  • Microsoft
    • Active Directory
    • Group Policy
    • SCCM
    • SCOM
    • Windows 10
    • Windows 11
    • Windows Server
    • WSUS
  • Software
  • Forums
  • Newsletter
  • Contact
Follow US

Home » SCCM » Find Who Modified ConfigMgr Task Sequence

SCCM

Find Who Modified ConfigMgr Task Sequence

By Prajwal Desai 1 View 1 comment January 23, 2021 5 Min Read

Did you ever wonder who modified ConfigMgr task sequence without any prior notice ?. ConfigMgr allows you to find out who created, modified, deleted the configuration manager packages, and Task Sequence. Using the status message queries, we will find out who modified the ConfigMgr Task Sequence.

In my previous post I covered the steps to find out who deleted the SCCM task sequence. You may refer that post when someone accidentally deletes the task sequence and you want to find out who did that.

Status Message Queries are one of the underappreciated features of ConfigMgr. The information you can gather in a quick and easy query will help you to determine the root cause analysis of an issue.

You can use status message queries to identify when a specific component, operation, or Configuration Manager object was modified or deleted, and the account that was used to make the modification. You can use it find who modified ConfigMgr task sequence

- Advertisement -
Ad image

In a separate post I will be publishing all the audit status message ID’s so that you can use them when required.

Table of Contents

  • Find Who Modified ConfigMgr Task Sequence
    • Find who Created the Package Properties of a Task Sequence
    • Find Who Modified the Package Properties of a Task Sequence
  • Who Modified SCCM Task Sequence – Status Message Viewer

Find Who Modified ConfigMgr Task Sequence

Let’s find out who modified the ConfigMgr Task Sequence using status message queries. When I say modified a task sequence, it includes two things.

  • User who Created the package properties of the task sequence.
  • User who Modified the package properties of the task sequence.

Find who Created the Package Properties of a Task Sequence

In this step we will find the user who created the package properties of the task sequence.

  • Launch the SQL Server Management studio and login.
  • Expand Databases and right click your ConfigMgr database and click New Query.
  • Enter the below query to find the user who created the package properties of SCCM task sequence.
/* Find the user who Created the Package Properties of a Task Sequence */
select * from vStatusMessagesWithStrings where MessageID = 30000

When you run the above query, in the query output, take a look at InsStrValue1, InsStrValue2, InsStrValue3 values.

  • InsStrValue1 – The user account who created the package properties in the task sequence.
  • InsStrValue2 – The package ID.
  • Time – The date and time when the task sequence was deleted.
  • InsStrValue3 – The actual name of the package.
Track the user who Created the Package Properties of a Task Sequence
Track the user who Created the Package Properties of a Task Sequence

Find Who Modified the Package Properties of a Task Sequence

In this step we will find the user who modified the package properties of the task sequence.

  • Launch the SQL Server Management studio and login.
  • Expand Databases and right click your ConfigMgr database and click New Query.
  • Enter the below query to find user who modified the package properties of SCCM task sequence.
/* Find Who modified the Package Properties of a Task Sequence */
select * from vStatusMessagesWithStrings where MessageID = 30001

When you run the above query, in the query result, take a look at InsStrValue1, InsStrValue2, InsStrValue3 values.

  • InsStrValue1 – The user account who modified the package properties in the task sequence.
  • InsStrValue2 – The package ID.
  • Time – The date and time when the task sequence was deleted.
  • InsStrValue3 – The actual name of the package.
Find Who Modified ConfigMgr Task Sequence
Find Who Modified ConfigMgr Task Sequence

Who Modified SCCM Task Sequence – Status Message Viewer

In addition to above methods, you can use the SCCM status message viewer tool to find who modified the ConfigMgr task sequence. If you don’t want to run query against the database you can always use the Configuration Manager status message viewer tool.

  • First of all, launch the Configuration Manager console.
  • Go to Monitoring\Overview\System Status\Status Message Queries.
  • Right click All Status Messages and click Show Messages.
  • Use the filter option and enter the message ID as 30001 and click OK.
  • The Audit message description with Message ID 30001 should tell you who modified the task sequence.
Find Who Modified ConfigMgr Task Sequence
Find Who Modified ConfigMgr Task Sequence

Sign Up For Weekly Newsletter

Get the most recent information on Configuration Manager, Intune, Windows 11, Windows 365, Autopilot, Azure, Software Reviews, and much more by subscribing to the newsletter.
By signing up, you agree and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Share this Article
Facebook Twitter Copy Link Print
Avatar photo
By Prajwal Desai
Follow:
Prajwal Desai is a Microsoft MVP in Enterprise Mobility. He writes articles on SCCM, Intune, Configuration Manager, Microsoft Intune, Azure, Windows Server, Windows 11, WordPress and other topics, with the goal of providing people with useful information.
Previous Article Download of Office 365 file failed Error Fix: Download of Office 365 file failed, Error =
Next Article ConfigMgr Technical Preview 2010.2 ftimg Latest ConfigMgr Technical Preview 2010.2
1 Comment 1 Comment
  • Avatar photo Kamil says:
    August 18, 2022 at 7:14 pm

    Great Article, really helpfull. Thanks a lot!!!

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recast Sponsored AD
Ad image
Patch My PC Sponsored AD
Ad image

Latest Articles

Fix Windows Autopilot Reset Error 0x80070032
Fix Windows Autopilot Reset Error 0x80070032
Autopilot Intune
Windows activation error 0xc004c020
Fix: Windows Activation Error 0xC004C020 with 2 Easy Methods
Windows 11 Windows 10
Find the Package ID of SCCM Application
3 Best Ways to Find the Package ID of SCCM Application
SCCM
SCCM Updates Install Error 0x800b0109 0x8024b303
Fix: SCCM Updates Install Error 0x800b0109 | 0x8024b303
SCCM
Subscribe to Our Newsletter

Subscribe to our newsletter to get our newest articles instantly!

You Might Also Like

Find the Package ID of SCCM Application
SCCM

3 Best Ways to Find the Package ID of SCCM Application

By Prajwal Desai
SCCM Updates Install Error 0x800b0109 0x8024b303
SCCM

Fix: SCCM Updates Install Error 0x800b0109 | 0x8024b303

By Prajwal Desai
ConfigMgr Technical Preview 2302 New Features
SCCM

ConfigMgr Technical Preview 2302 New Features | Baseline Version

By Prajwal Desai

Removed from reading list

Undo
Welcome Back!

Sign in to your account

Lost your password?