This blog post will be a short follow-up post on my previous blog post about Who created that deployment?. This post will answer the, in most cases, less important question about who deleted that deployment. Just like the information about the creation of a deployment, the information about the deletion of a deployment is also stored in the database.
Use the same buildin report named All messages for a specific message ID to track the deleted deployment. Again, the only missing detail is that it’s not clear which Message ID belongs to which action. The following table provides an overview with exactly that information. It will show per object type which Message ID belongs to the deletion of a(n) deployment/ assignment.
Object | Status Message | Message ID |
Application | User “<>” deleted the deployment of application “<>” to collection “<>”. | 30228 |
Package | User “<>” deleted a deployment named “<>” deploying program “<>”. | 30008 |
Task Sequence | User “<>” deleted a deployment named “<>” deploying program “<>”. | 30008 |
Software Updates | User “<>” deleted updates assignment “<>”. | 30198 |
Configuration Baseline | User “<>” deleted updates assignment “<>”. | 30198 |
User Data and Profiles Configuration | User “<>” deleted configuration policy assignment “<>”. | 40702 |
Remote Connection Profiles | User “<>” deleted configuration policy assignment “<>”. | 40702 |
Certificate Profile | User “<>” deleted configuration policy assignment “<>”. | 40702 |
Email Profile | User “<>” deleted configuration policy assignment “<>”. | 40702 |
VPN Profile | User “<>” deleted configuration policy assignment “<>”. | 40702 |
Wi-Fi Profile | User “<>” deleted configuration policy assignment “<>”. | 40702 |
Antimalware Policy | User “<>” deleted client settings assignment “<>”. | 40305 |
Windows Firewall Policy | User “<>” deleted configuration policy assignment “<>”. | 40702 |
Client Settings | User “<>” deleted client settings assignment “<>”. | 40305 |
Excellent article, helped me find a deleted deployment!!
Hey, so 30198 messages are not available as an option in my 1902 environment…. any idea whats going on here ? is there something i need to do to enabled auditing on deletion ?
Hi Ben,
What message id do you get when you delete a software update deployment?
Regards, Peter
Usefull
But I couldn’t find who deleted our ‘All EMEA Distribution Points’
Where would I be able to find that kind of information?
Found it: MessageID 40402 does the trick for this one..
Thank you for letting us know that you’ve found the answer!
Regards, Peter