SCCM 2012 – Who created/modified/deleted the collection?

Ever stumbled on a collection that you did not know where came from? Or wondered who deleted a collection that you were using? It has happened to me a few times.

One way to find out who created, modified, or deleted a collection, is to use the SCCM built in report “All messages for a specific message ID”.

  • Click Monitoring.
  • Click on Reports.
  • Right click on “All messages for a specific message ID” and click Run. The report Viewer opens and requires you to input a value in the “Message ID” Box.


  • Click on Values.


  • Write the Value (Go to the end of this page to find the Value you need) in the Filter box, click on the Value in the Message ID box and then click OK.


  • Click “View Report” and now the information is located at the bottom of the GUI window.


Depending on how your system is set up, there could be a lot of messages in this report and you might need to use the search function (“7”) to find the collection you need information about.

Message ID’s:


This entry was posted in Uncategorized and tagged , , , , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s