Find Who Modified ConfigMgr Task Sequence

Did you ever wonder who modified ConfigMgr task sequence without any prior notice ?. ConfigMgr allows you to find out who created, modified, deleted the configuration manager packages, and Task Sequence. Using the status message queries, we will find out who modified the ConfigMgr Task Sequence.

In my previous post I covered the steps to find out who deleted the SCCM task sequence. You may refer that post when someone accidentally deletes the task sequence and you want to find out who did that.

Status Message Queries are one of the underappreciated features of ConfigMgr. The information you can gather in a quick and easy query will help you to determine the root cause analysis of an issue.

You can use status message queries to identify when a specific component, operation, or Configuration Manager object was modified or deleted, and the account that was used to make the modification. You can use it find who modified ConfigMgr task sequence

In a separate post I will be publishing all the audit status message ID’s so that you can use them when required.

Find Who Modified ConfigMgr Task Sequence

Let’s find out who modified the ConfigMgr Task Sequence using status message queries. When I say modified a task sequence, it includes two things.

• User who Created the package properties of the task sequence.
• User who Modified the package properties of the task sequence.

Find who Created the Package Properties of a Task Sequence

In this step we will find the user who created the package properties of the task sequence.

• Launch the SQL Server Management studio and login.
• Expand Databases and right click your ConfigMgr database and click New Query.
• Enter the below query to find the user who created the package properties of SCCM task sequence.

/* Find the user who Created the Package Properties of a Task Sequence */
select * from vStatusMessagesWithStrings where MessageID = 30000

When you run the above query, in the query output, take a look at InsStrValue1, InsStrValue2, InsStrValue3 values.

• InsStrValue1 – The user account who created the package properties in the task sequence.
• InsStrValue2 – The package ID.
• Time – The date and time when the task sequence was deleted.
• InsStrValue3 – The actual name of the package.

Find Who Modified the Package Properties of a Task Sequence

In this step we will find the user who modified the package properties of the task sequence.

• Launch the SQL Server Management studio and login.
• Expand Databases and right click your ConfigMgr database and click New Query.
• Enter the below query to find user who modified the package properties of SCCM task sequence.

/* Find Who modified the Package Properties of a Task Sequence */
select * from vStatusMessagesWithStrings where MessageID = 30001

When you run the above query, in the query result, take a look at InsStrValue1, InsStrValue2, InsStrValue3 values.

• InsStrValue1 – The user account who modified the package properties in the task sequence.
• InsStrValue2 – The package ID.
• Time – The date and time when the task sequence was deleted.
• InsStrValue3 – The actual name of the package.

Who Modified SCCM Task Sequence – Status Message Viewer

In addition to above methods, you can use the SCCM status message viewer tool to find who modified the ConfigMgr task sequence. If you don’t want to run query against the database you can always use the Configuration Manager status message viewer tool.

• First of all, launch the Configuration Manager console.
• Go to Monitoring\Overview\System Status\Status Message Queries.
• Right click All Status Messages and click Show Messages.
• Use the filter option and enter the message ID as 30001 and click OK.
• The Audit message description with Message ID 30001 should tell you who modified the task sequence.