Under Site Settings\Client Agents\Software Updates Client Agent someone Checked "Enable software updates on clients" No one is admitting they turned this on in a very large organization. I'm trying to find out who did this but I don't see this logged anyplace. I did look here: Status Message Queries\Server Component Configuration Changes but it only has 1 thing logged over and over and over. User "Domain\User" modified component "SMS_MP_CONTROL_MANAGER" on SMS Management Point in the site control file at site US1. Where can I find out who changed this setting? We know it happened in the past 15 days.

What about "All audit status messages for a specific site"?Torsten Meringer | http://www.mssccmfaq.de

That also does not show us what happened. But here is what has happened. We have the SCCM client on a handful of servers and suddenly many (not all) started to access SCCM for their WSUS updates. But since SCCM has not approved any updates these servers were not getting any updates applied. So we are trying to find out who made this change. Question for you: A couple of weeks ago (right around the time this started) I removed and re-added the Management Point Role from 2 Primary servers. Could that have caused some servers to change their WSUS server settings? That seems very unlikely but I put nothing past SCCM ;-) mqh7

No, removing and readding a MP does not affect policies. Just change that client agent setting in a testlab and run the "All status messages" query. You'll see easily if that created a status message.Torsten Meringer | http://www.mssccmfaq.de