Sunday, January 29, 2017

Audit who made changes to WSUS configuration

If you need to find an admin, who made changes to WSUS configuration, then the first place to look is %programfiles%\Update Services\LogFiles\Change.log

You will see there an entry which user has made the change, but there will not be written specific configuration change made:
(I am using SCCM CMTrace tool to view the log)


No comments:

Post a Comment