add computer to collection log

[peggyp]

quick question,

 

I am logged in as 'admin' to sccm console. I have an approved client 'a' in sccm. it shows in the all systems collection. Then i add it to collection 'b' by right-clicking and clicking on add to collection.

 

is there any entry in any of the logs that 'admin' has added 'a' into collection 'b'?

 

TIA,

peggy

[Gregory B]

Hi,

 

All the infos on the collection are logged on the colleval.log : http://www.windows-noob.com/forums/index.php?/topic/1105-sccm-logs/

 

Gregory B

[Trevor Sullivan]

Hi Peggy,

 

I'm not sure that, that level of detail is logged anywhere in ConfigMgr. You can subscribe for change events using the ConfigMgr WMI provider, but you still probably won't be able to know exactly who made the change.

 

Here is a PowerShell module that will help you subscribe for and respond to WMI events, such as ConfigMgr collection change events.

 

http://powerevents.codeplex.com

 

Cheers,

Trevor Sullivan

http://trevorsullivan.net

http://twitter.com/pcgeek86

[Peter33]

Maybe this will help you. I'm using this query to see who made changes on collections. You can see the collection name, user name and the time of the change, but not exactly which action was performed. This level of logging would burst your database.

Here is the query.

 

select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID >= 30015 and stat.MessageID <= 30017 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc

[Peter van der Woude]

You could also take a look at the Status Message Queries. There are also some buildin queries on collection level.

 

See also: http://blogs.technet.com/b/meamcs/archive/2011/01/17/step-by-step-how-to-audit-configuration-manager-2007-activities.aspx