SCCM Scripts Auditing

J.S 156 Reputation points
2021-03-03T23:58:54.393+00:00

Hi,
Using SCCM Administration Console or PowerShell how can I determine who (user login) ran a specific script that is listed in "Script Status" history?
I can only see Operation ID, Script Name, CollectionID, etc...

Is it possible to retrieve the user that ran the script using PowerShell?

Thank you.

Microsoft Configuration Manager
0 comments No comments
{count} votes

Accepted answer
  1. Fiona Yan-MSFT 2,311 Reputation points
    2021-03-04T06:31:21.977+00:00

    @J.S

    Thank you for posting in Microsoft Q&A forum.

    I have done this in my lab and we could check the user name by showing the message on all status message.

    • Located this path on SCCM console: \Monitoring\Overview\System Status\Status Message Queries.
      74133-image.png
    • Select the date of running period like the image below:
      74161-image.png
    • Find the message ID of the script and then we could filter it.
      74134-3-4.png
      74171-image.png
    • Then, we could check the result from the description.
      74118-image.png

    Have a good day!


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 additional answers

Sort by: Most helpful