Quick Post: There was a question on TechNet forum asking,about who created the collection ,More read http://social.technet.microsoft.com/Forums/en-US/e5ea645e-84ec-49ce-82f5-e5d92b0f49a5/details-on-sccm-collection-creation?forum=configmanagergeneral
I have seen few cases in Configmgr 2007 and less in Configmgr 2012 due to RBA ,that Configmgr guys will try to do something on collection but it ends at something that causes the resources to disappear from Configmgr database and later you know the consequences from top management. The easiest way to get the resources into Configmgr is,to run the discovery.
Recently peter posted a blog about Who created that deployment and who deleted that deployment but these posts mainly focus on the deployment part using Reports.
Through this post,i will provide you the information about collections like who created,who Modified ,who deleted and who deleted resources from the collection etc using Reports.
Unlike Configmgr 2007 ,Configmgr 2012 also have few ways to get the information about this 1) using Status messages queries 2 ) Default reports 3) Using SQL queries
I always prefer to use the Default report in Configmgr called ‘All messages for a specific message ID’ under status messages folder from your Configmgr SSRS reports folder to know who created ,deleted as other 2 methods are little complicated to search for the required information(compared to reports) and to write SQL queries.
So coming to the subject,you can run the default report but you need to know the description of the status message ID what you are looking for.
You can use below status message ID’s to know who did what on collections.
| Message ID | Description |
| 30015 | User "<>" created a collection named "Coll Name" (CollID) |
| 300016 | User "<>" modified the Collection Properties for a collection named "Coll Name" (CollID) |
| 300017 | User "<>" deleted a collection named "Coll Name" (CollID) |
| 300067 | User "<>" deleted all of the resources that belong to collection "Coll Name" (CollID) |
| 30104 | User "<>" requested that the membership be refreshed for collection "Coll Name" (CollID) |
| 30107 | User "<>" requested that the CCRs be generated for collection "Coll Name" (CollID) |
Report Results for Who deleted what Collections ?
If you are looking for information about Configmgr 2007,refer this post http://blogs.technet.com/b/configurationmgr/archive/2013/10/01/how-to-determine-who-deleted-what-objects-in-the-configuration-manager-console.aspx
Hope it helps.
SCCM Configmgr 2012 way to find Who Created modified Deleted the collection using SSRS Reports is a post from: Eswar Koneti's Blog