is there any way to find out who has modified /deleted sccm audit logs ?

Question

I could find that there is some major settings changed in on going PROD deployment and  tried to find out who has done that ? I have checked the same in Audit logs I couldn’t find any  single entry related to same  deployment. It is happening very often in my environment. Any one plz help ?

in progress 0
Rasna Soorej 2022-03-03T16:20:20+05:30 1 Answer 57 views Beginner
0

Answer ( 1 )

  2. HowToManage Devices
    0
    2022-03-03T16:57:29+05:30
    Reply

    It’s difficult we have not seen this kind of alert or options out of the box.

    But we are sure in the digital world everything is traceable. There would be some events stored related to WMI somewhere or it should be somewhere in SQL DB somewhere.

    Do you know whether the SCCM admin deleted the audit logs from the console or from the SQL database?

    depending on that you will need to instigate further or engage security experts to perform forensic analysis on their system or terminal server.

Leave an answer

Sorry, you do not have permission to answer to this question .