Find who last modified a collection in SCCM

There will come a time when you need to determine who created, modified or deleted a collection.  Here is a quick and easy method to get this information from ConfigMgr.

1. Click on Monitoring.
2. Expand Reporting and click on Reports.
   
3. Right-click ‘All messages for a specific message ID’ and select Run.
4. Click Values.
   
5. Enter the Message ID based on what you are looking for.
   30015 – user created collection
   30016 – user modified collection
   30017 – user deleted a collection
6. Select the Message ID from the list and click Ok.
   
7. Click View Report.
8. This report will show you the user, collection and time of the change.