I have a client that installed software outside of my defined maintenance Windows. I ran the report and no maintenance windows were active for that period.

I checked the servicewindowmanager.log and found:

        Biggest Active Service Window has ID = 45dca355-3249-4845-b8aa-72d0e604548e having Starttime=27/05/2015 22:00:00 ServiceWindowManager 28/05/2015 02:00:09 3820 (0x0EEC)

I used policy spy and found the same maintenance window. I think opened the sql view for service windows and found that the id did not exist:

SELECT * FROM v_ServiceWindow where ServiceWindowID like '%45dca355-3249-4845-b8aa-72d0e604548e%'

and it did not find a result.

My question is, can I find historic view of service windows and who created them?

Hi,

Have you tried the following command on the other machines?

Get-WmiObject -Class CCM_ServiceWindow -Namespace ROOT\ccm\Policy\machine

If I run the command, I can see the same server window ID. Based on the statement in servicewindowmanager.log. I guess it might business hours. Not known for sure.

Anyway, check if "Automatically install or uninstall required software and restart the computer only outside of the specified business hours" is checked in software center. And user may also trigger a manually installation. So please check the time stamp that this software is installed.

This will be helpful to understand business hours and maintanence window.

Business Hours vs. Maintenance Windows with System Center 2012 Configuration Manager