Sometimes things just broke, and after hours of troubleshooting, you realize that someone made some changes to the SCCM infrastructure, and you want to find out who made the changes. How?
Under the Monitoring – System Status – Status Message Queries, you can use “All Audit Status Messages from a Specific Site”
To figure out the mass messages, you can use Message ID, such as 30034 or 30031, depends on the items you want to check.
One down size is that this message got erased pretty frequently, so if you want to track down the changes made a few weeks ago, you don’t able to check them here.