I want know who had deleted Group name and when ?

My database is simple mode.

Hi,

As far as I know theres not a real audit trail available for these kind of operations. One thing is certain, it was one of the SCOM administrators. Normally that brings down the number of possibilities.

You can check event logs to get who logged on then narrow down who did that.

Regards,

Yan Li

Hi There,

Based on my knowledge, Not all things here can be audited. Below is what i know what can be audited.

1. Who closed the alert from SCOM Console

2. Who put a device in maintenance mode.

3. Who created a subscription

4. When overrides were altered.

5. When a specific agent was deleted even it is a quiet old agent data for the same will be available.