Who deleted that deployment?

WhoDeletedThatDeploymentThis blog post will be a short follow-up post on my previous blog post about Who created that deployment?. This post will answer the, in most cases, less important question about who deleted that deployment. Just like the information about the creation of a deployment, the information about the deletion of a deployment is also stored in the database.

Use the same buildin report named All messages for a specific message ID to track the deleted deployment. Again, the only missing detail is that it’s not clear which Message ID belongs to which action. The following table provides an overview with exactly that information. It will show per object type which Message ID belongs to the deletion of a(n) deployment/ assignment.

Object Status Message Message ID
Application User “<>” deleted the deployment of application “<>” to collection “<>”. 30228
Package User “<>” deleted a deployment named “<>” deploying program “<>”. 30008
Task Sequence User “<>” deleted a deployment named “<>” deploying program “<>”. 30008
Software Updates User “<>” deleted updates assignment “<>”. 30198
Configuration Baseline User “<>” deleted updates assignment “<>”. 30198
User Data and Profiles Configuration User “<>” deleted configuration policy assignment “<>”. 40702
Remote Connection Profiles User “<>” deleted configuration policy assignment “<>”. 40702
Certificate Profile User “<>” deleted configuration policy assignment “<>”. 40702
Email Profile User “<>” deleted configuration policy assignment “<>”. 40702
VPN Profile User “<>” deleted configuration policy assignment “<>”. 40702
Wi-Fi Profile User “<>” deleted configuration policy assignment “<>”. 40702
Antimalware Policy User “<>” deleted client settings assignment “<>”. 40305
Windows Firewall Policy User “<>” deleted configuration policy assignment “<>”. 40702
Client Settings User “<>” deleted client settings assignment “<>”. 40305

7 thoughts on “Who deleted that deployment?”

  1. Hey, so 30198 messages are not available as an option in my 1902 environment…. any idea whats going on here ? is there something i need to do to enabled auditing on deletion ?

    Reply
  2. Usefull
    But I couldn’t find who deleted our ‘All EMEA Distribution Points’
    Where would I be able to find that kind of information?

    Reply

Leave a Reply to Peter van der Woude Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.