Who cleared last PXE Advertisement

[TomF]

Hey everyone, we recently ran into an issue where one of our tech's cleared the pxe advertisement on an entire collection, causing multiple machines to reimage themselves. I have been researching and looking through the logs, but unable to find any details as to who did it, and when. We have our security rights setup where only a select few users (based on AD accounts) have the ability to clear advertisements and am hoping this action is logged somewhere with their username.

 

Does anyone know where these are stored? I have also looked through some of the available Reports but can't find much information on PXE Advertisements being cleared.

 

Any help would be greatly appreciated!!!

[AkumaUk]

I'm not 100% it is logged anywhere, I can't test at the moment, but there are two places I would look:

 

In the SCCM Console, Site Status > State Message Queries > All Status Messages and then set a time range for the required logs.

 

Outside of the SCCM console, try having a look in the AdminUi.log in 'Program Files\Microsoft Configuration Manager\AdminUi\Logs' and see if that has anything.

 

Please let us know if you find anything!

[TomF]

Both good ideas but couldn't find anything in the Queries or the client log files

 

Still can't find much info on it being logged somewhere. Would seem kind of odd that the clear PXE advertisement task wouldn't be logged somewhere since you need specific permission to do so in the SCCM client.

 

Thanks for the reply and please let me know if you ever come across something!