Search This Blog

Sunday, January 29, 2017

Audit who made changes to WSUS configuration

If you need to find an admin, who made changes to WSUS configuration, then the first place to look is %programfiles%\Update Services\LogFiles\Change.log

You will see there an entry which user has made the change, but there will not be written specific configuration change made:
(I am using SCCM CMTrace tool to view the log)


No comments:

Post a Comment