%3CLINGO-SUB%20id%3D%22lingo-sub-884897%22%20slang%3D%22en-US%22%3EEnhanced%20Audit%20Status%20Message%20Queries%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-884897%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3E%20First%20published%20on%20TECHNET%20on%20Mar%2018%2C%202019%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CI%3E%20Authored%20by%20Brandon%20McMillan%20%3C%2FI%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EHello%20everyone!%26nbsp%3B%20My%20name%20is%20Brandon%20McMillan%20and%20I%20am%20a%20System%20Center%20Configuration%20Manager%20(ConfigMgr)%20PFE.%26nbsp%3B%20I%20have%20found%20that%20Status%20Message%20Queries%20can%20be%20one%20of%20the%20more%20underappreciated%20features%20of%20ConfigMgr.%26nbsp%3B%20The%20information%20you%20can%20gather%20in%20a%20quick%20and%20easy%20query%20can%20be%20very%20powerful%20in%20helping%20you%20determine%20the%20root%20cause%20analysis%20of%20an%20issue.%26nbsp%3B%20I%20hope%20this%20blog%20will%20provide%20you%20with%20additional%20Status%20Message%20Queries%20and%20how%20you%20can%20quickly%20export%2Fimport%20some%20examples%20into%20your%20environment.%20%3CBR%20%2F%3E%3CBR%20%2F%3EFirst%20let%E2%80%99s%20break%20down%20the%20different%20%3CSTRONG%3E%3CEM%3E%20Status%20Message%20Types%3C%2FEM%3E%3C%2FSTRONG%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20style%3D%22height%3A%20391px%3B%22%20width%3D%22709%22%3E%0A%3CTBODY%3E%0A%3CTR%20style%3D%22height%3A%2065px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%2052.2222px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId-1037870036%22%20id%3D%22toc-hId-1037870036%22%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%20%3CSTRONG%3E%20ID%20%3C%2FSTRONG%3E%20%3C%2FSPAN%3E%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%20178.889px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId--1514286925%22%20id%3D%22toc-hId--1514286925%22%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%20%3CSTRONG%3E%20Status%20Message%20Type%20%3C%2FSTRONG%3E%20%3C%2FSPAN%3E%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%20476.667px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId-228523410%22%20id%3D%22toc-hId-228523410%22%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%20%3CSTRONG%3E%20Description%20%3C%2FSTRONG%3E%20%3C%2FSPAN%3E%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2065px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%2052.2222px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId-1971333745%22%20id%3D%22toc-hId-1971333745%22%3E256%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%20178.889px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId--580823216%22%20id%3D%22toc-hId--580823216%22%3EMilestones%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22text-align%3A%20left%3B%20height%3A%2065px%3B%20width%3A%20476.667px%3B%22%3E%3CH6%20id%3D%22toc-hId-1161987119%22%20id%3D%22toc-hId-1161987119%22%3EUse%20this%20type%20at%20the%20end%20of%20an%20operation%20to%20indicate%20the%20operation's%20success%20or%20failure.%20If%20the%20operation%20was%20successful%2C%20use%20the%20Milestone%20type%20in%20an%20informational%20message.%20If%20the%20operation%20failed%2C%20use%20a%20milestone%20message%20type%20in%20a%20warning%20or%20error%20message.%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2091px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2091px%3B%20width%3A%2052.2222px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId--1390169842%22%20id%3D%22toc-hId--1390169842%22%3E512%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2091px%3B%20width%3A%20178.889px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId-352640493%22%20id%3D%22toc-hId-352640493%22%3EDetails%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2091px%3B%20width%3A%20476.667px%3B%22%3E%3CH6%20id%3D%22toc-hId-2095450828%22%20id%3D%22toc-hId-2095450828%22%3EUse%20this%20type%20to%20illustrate%20the%20steps%20in%20a%20complex%20operation.%20Often%2C%20detail%20messages%20are%20meaningful%20only%20within%20the%20context%20of%20the%20sequence%20of%20status%20messages%20representing%20a%20complex%20operation.%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%20105px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%20105px%3B%20width%3A%2052.2222px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId--456706133%22%20id%3D%22toc-hId--456706133%22%3E768%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%20105px%3B%20width%3A%20178.889px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId-64596647%22%20id%3D%22toc-hId-64596647%22%3EAudits%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%20105px%3B%20width%3A%20476.667px%3B%22%3E%3CH6%20id%3D%22toc-hId-1807406982%22%20id%3D%22toc-hId-1807406982%22%3EUse%20this%20type%20for%20informational%20messages%20that%20provides%20a%20trail%20of%20actions%20taken%20by%20the%20Configuration%20Manager%20administrator.%20An%20audit%20message%20also%20depicts%20an%20operation%20that%20results%20in%20objects%20being%20added%2C%20modified%2C%20or%20deleted.%20You%20do%20not%20need%20to%20create%20audit%20messages%3B%20the%20provider%20automatically%20generates%20these%20messages%20for%20you.%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2065px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%2052.2222px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId--744749979%22%20id%3D%22toc-hId--744749979%22%3E1024%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%20178.889px%3B%22%3E%3CBR%20%2F%3E%3CH6%20id%3D%22toc-hId-998060356%22%20id%3D%22toc-hId-998060356%22%3ENT%20Events%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2065px%3B%20width%3A%20476.667px%3B%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%3CBR%20%2F%3EReference%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsccm%2Fdevelop%2Freference%2Fcore%2Fservers%2Fmanage%2Fsms_statusmessage-server-wmi-class%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20SMS_StatusMessage%20WMI%20Class%20%3C%2FA%3E%20%3CBR%20%2F%3E%3CBR%20%2F%3EHere%20is%20a%20quick%20overview%20of%20%3CEM%3E%20%3CSTRONG%3E%20Status%20Message%20Queries%3C%2FSTRONG%3E%3C%2FEM%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20width%3D%22710%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%3E%3CBR%20%2F%3E%3CH6%20style%3D%22text-align%3A%20left%3B%22%20id%3D%22toc-hId--1554096605%22%20id%3D%22toc-hId--1554096605%22%3EStatus%20Message%20Queries%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3CTD%20class%3D%22%22%3E%3CH6%20style%3D%22padding-left%3A%2030px%3B%22%20id%3D%22toc-hId-188713730%22%20id%3D%22toc-hId-188713730%22%3EUse%20this%20node%20to%20query%20status%20messages%20for%20specific%20events%20and%20related%20details.%20You%20can%20use%20status%20message%20queries%20to%20find%20the%20status%20messages%20related%20to%20specific%20events.%3C%2FH6%3E%0A%3CH6%20style%3D%22padding-left%3A%2030px%3B%22%20id%3D%22toc-hId-1931524065%22%20id%3D%22toc-hId-1931524065%22%3EYou%20can%20often%20use%20status%20message%20queries%20to%20identify%20when%20a%20specific%20component%2C%20operation%2C%20or%20Configuration%20Manager%20object%20was%20modified%2C%20and%20the%20account%20that%20was%20used%20to%20make%20the%20modification.%20For%20example%2C%20you%20can%20run%20the%20built-in%20query%20for%20%3CSTRONG%3E%20Collections%20Created%2C%20Modified%2C%20or%20Deleted%20%3C%2FSTRONG%3E%20to%20identify%20when%20a%20specific%20collection%20was%20created%2C%20and%20the%20user%20account%20used%20to%20create%20the%20collection.%3C%2FH6%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%3CBR%20%2F%3EReference%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsccm%2Fcore%2Fservers%2Fmanage%2Fuse-alerts-and-the-status-system%23bkmk_Status%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Use%20Alerts%20and%20the%20Status%20System%3C%2FA%3E%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-475253885%22%20id%3D%22toc-hId-475253885%22%3E%26nbsp%3B%3C%2FH3%3E%0A%3CH3%20id%3D%22toc-hId--2076903076%22%20id%3D%22toc-hId--2076903076%22%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%3B%22%3E%3CSTRONG%3EEnumerating%20Status%20Message%20Strings%20%3C%2FSTRONG%3E%20%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%3CBR%20%2F%3EHow%20can%20we%20obtain%20a%20full%20listing%20of%20Status%20Message%20ID%E2%80%99s%3F%26nbsp%3B%20If%20you%20are%20unsure%20what%20Status%20Message%20ID%E2%80%99s%20to%20use%20to%20create%20a%20specific%20Status%20Message%20Query%2C%20you%20can%20export%20all%20the%20Status%20Messages%20ConfigMgr%20provides%20by%20using%20a%20PowerShell%20script%20from%20an%20article%20by%20%3CSTRONG%3E%20SaudM%20%3C%2FSTRONG%3E%20.%26nbsp%3B%20The%20script%20and%20an%20example%20of%20an%20excel%20output%20from%20a%20ConfigMgr%202012%20R2%20environment%20can%20be%20found%20here%3A%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fgallery.technet.microsoft.com%2FEnumerate-status-message-6e7e1761%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Enumerate%20Status%20Messages%3C%2FA%3E%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EHere%E2%80%99s%20an%20example%20of%20how%20you%20can%20leverage%20the%20script%20and%20export%20the%20Status%20Messages%20based%20on%20type%3A%20Client%2C%20Provider%2C%20or%20Server%20Messages.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH5%20id%3D%22toc-hId-366971837%22%20id%3D%22toc-hId-366971837%22%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%20%3CEM%3E%20Client%20Messages%3C%2FEM%3E%3C%2FSPAN%3E%3C%2FH5%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E.%5CExport-StatusMessages.ps1%20-stringPathToDLL%20%22%26lt%3BInstallDrive%26gt%3B%3A%5CProgram%20Files%5CMicrosoft%20Configuration%20Manager%5Cbin%5CX64%5Csystem32%5Csmsmsgs%5Cclimsgs.dll%22%20-stringOutputCSV%20ExportClientMsgs.csv%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH5%20id%3D%22toc-hId-54093543%22%20id%3D%22toc-hId-54093543%22%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%20%3CEM%3E%20Provider%20Messages%3C%2FEM%3E%3C%2FSPAN%3E%3C%2FH5%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E.%5CExport-StatusMessages.ps1%20-stringPathToDLL%20%22%26lt%3BInstallDrive%26gt%3B%3A%5CProgram%20Files%5CMicrosoft%20Configuration%20Manager%5Cbin%5CX64%5Csystem32%5Csmsmsgs%5Cprovmsgs.dll%22%20-stringOutputCSV%20ExportProviderMsgs.csv%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH5%20id%3D%22toc-hId-1796903878%22%20id%3D%22toc-hId-1796903878%22%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%20%3CEM%3E%20Server%20Messages%3C%2FEM%3E%3C%2FSPAN%3E%3C%2FH5%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E.%5CExport-StatusMessages.ps1%20-stringPathToDLL%20%22%26lt%3BInstallDrive%26gt%3B%3A%5CProgram%20Files%5CMicrosoft%20Configuration%20Manager%5Cbin%5CX64%5Csystem32%5Csmsmsgs%5Csrvmsgs.dll%22%20-stringOutputCSV%20ExportServerMsgs.csv%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1456317661%22%20id%3D%22toc-hId--1456317661%22%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%3B%22%3E%20%3CSTRONG%3E%20Default%20Status%20Message%20Queries%20%3C%2FSTRONG%3E%20%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20provide%20many%20out%20of%20box%20queries%20that%20are%20delivered%20with%20the%20product%3B%20however%2C%20there%20are%20many%20Message%20ID%E2%80%99s%20that%20you%20can%20leverage%20which%20could%20help%20you%20build%20your%20own%20specific%20queries%20for%20your%20environment.%20Some%20of%20the%20default%20Status%20Message%20Queries%20you%20may%20already%20be%20familiar%20with%20are%20below%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20width%3D%22739%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22427%22%3E%3CFONT%20size%3D%222%22%3E%3CSTRONG%3EQuery%20Title%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22312%22%3E%3CSTRONG%3E%3CFONT%20size%3D%222%22%3EQuery%20Details%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAll%20Audit%20Status%20Messages%20for%20a%20Specific%20User%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22312%22%3E%3CFONT%20size%3D%222%22%3EMessage%20Type%3A%20768%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20Attribute%20ID%3A%20403%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAll%20Audit%20Status%20Messages%20from%20a%20Specific%20Site%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20Type%3A%20768%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EBoundaries%20Created%2C%20Modified%2C%20or%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2040600-40602%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EClient%20Component%20Configuration%20Changes%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030042-30047%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3ECollections%20Created%2C%20Modified%2C%20or%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030015-30017%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3ECollection%20Member%20Resources%20Manually%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030066-30067%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EDeployments%20Created%2C%20Modified%2C%20or%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030006-30008%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EPackages%20Created%2C%20Modified%2C%20or%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22312%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Package%20Conversion%20Status%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030000-30002%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EPrograms%20Created%2C%20Modified%2C%20or%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22312%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Package%20Conversion%20Status%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030003-30005%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EQueries%20Created%2C%20Modified%2C%20or%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030063-30065%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3ERemote%20Control%20Activity%20at%20a%20Specific%20Site%2C%20User%2C%20or%20System%20(4%20Total)%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030069-30087%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3ESecurity%20Scopes%20Created%2C%20Modified%2C%20Deleted%2C%20or%20Imported%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2031200-31202%20%2F%2031220-31222%20%2F%2031207%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EServer%20Component%20Configuration%20Changes%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22312%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030033-30035%20%2F%2030039-30041%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3ESite%20Control%20Changes%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3ESite%20Addresses%20Created%2C%20Modified%2C%20or%20Deleted%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030018-30020%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CH3%20id%3D%22toc-hId-286492674%22%20id%3D%22toc-hId-286492674%22%3E%26nbsp%3B%3C%2FH3%3E%0A%3CH3%20id%3D%22toc-hId-2029303009%22%20id%3D%22toc-hId-2029303009%22%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%3B%22%3E%3CSTRONG%3EEnhanced%20Audit%20Status%20Message%20Queries%20%3C%2FSTRONG%3E%20%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20what%20if%20you%20need%20something%20more%20specific%3F%26nbsp%3B%20The%20following%20list%20may%20help%20you%20quickly%20determine%20what%20specific%20activities%20are%20occurring%20within%20your%20environment.%26nbsp%3B%20A%20direct%20link%20to%20TechNet%20gallery%20of%20the%20exported%20Status%20Message%20Queries%20is%20located%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fgallery.technet.microsoft.com%2FEnhanced-Audit-Status-b531b235%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20%3CSTRONG%3E%20Enhanced%20Audit%20Status%20Message%20Queries%20%3C%2FSTRONG%3E%20%3C%2FA%3E%20.%26nbsp%3B%20This%20was%20last%20updated%20from%20a%20ConfigMgr%20version%201810%20environment.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20width%3D%22966%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22427%22%3E%3CSTRONG%3E%3CFONT%20size%3D%222%22%3EQuery%20Title%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CSTRONG%3E%3CFONT%20size%3D%222%22%3EQuery%20Details%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Alert%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20DRS%20Alerts%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030240-30244%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Application%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030226-30228%20%2F%2049003-49005%20%2F%2052300%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Application%20Catalog%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030800-30805%20%2F%2050000-50004%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Asset%20Intelligence%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030208-30209%20%2F%2031001%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Azure%20and%20Co-Management%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2053001-53005%20%2F%2053401-53403%20%2F%2053501-53503%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Boundary%20Group%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2040500-40505%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Client%20and%20Collection%20Miscellaneous%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Update%20Membership%2C%20Device%20Imports%2C%20Clear%20PXE%20Deployments%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030104%20%2F%2030213%20%2F%2042021%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Client%20Configuration%20Requests%20(CCRs)%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EClient%20Push%20actions.%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030106-30111%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Client%20Operations%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20%E2%80%9CRight%20Click%E2%80%9D%20actions.%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2040800-40804%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Client%20Settings%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Antimalware%20Policies.%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2040300-40305%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20CMPivot%20and%20Script%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2040805-40806%20%2F%2052500-52505%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Conditional%20Access%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Exchange%20Online%2C%20SharePoint%20Online%2C%20and%20On-Prem%20Exchange%20actions.%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030340-30341%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20ConfigMgr%20Actions%20in%20Console%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EChecks%20components%3A%20Microsoft.ConfigurationManagement.exe%20%2F%20AdminUI.PS.Provider.dll%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Configuration%20Baseline%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030168%20%2F%2030193-30198%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Configuration%20Items%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Compliance%20Settings%20and%20Endpoint%20Protection%20policy%20actions.%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030152-30167%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Content%20Library%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Content%20Library%20changes%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030080%20%2F%2030189-30191%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Distribution%20Point%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030009-30011%20%2F%2030068%20%2F%2030109%20%2F%2030125%20%2F%2030500-30503%20%2F%2040409-40410%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Distribution%20Point%20Changes%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2040400-40409%20%2F%2040506%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Folder%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030113-30117%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Messages%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Messages%20(Specified%20Message%20ID)%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Messages%20(Specified%20Timeline)%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Migration%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030900-30907%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Mobile%20Device%20Management%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2040200-40206%20%2F%2045000-45004%20%2F%2047000-47002%20%2F%2048000-48003%20%2F%2049003-49005%20%2F%2051000-51006%20%2F%2052000-52020%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Phased%20Deployment%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2053601-53603%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Query%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030063-30065%20%2F%2030302-30303%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Report%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030091-30093%20%2F%2031000-31002%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Search%20Folder%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030700-30702%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Secondary%20Site%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030012-30014%20%2F%2030021-30023%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Site%20Server%20Boundary%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030054-30056%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Site%20Server%20Definition%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030030-30032%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Site%20Server%20Property%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030024-30029%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Site%20Server%20Role%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030036-30038%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Site%20Server%20Security%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030057-30062%20%2F%2030210-30212%20%2F%2031200-31242%20%2F%2031203-31249%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Site%20Server%20SQL%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EIncludes%20Site%20Maintenance%20Tasks%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030048-30053%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Software%20Metering%20Rules%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030094-30095%20%2F%2030105%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20Software%20Update%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030112%20%2F%2030118-30124%20%2F%2030135-30137%20%2F%2030172%20%2F%2030183-30188%20%2F%2030196-30198%20%2F%2030219-30221%20%2F%2030229-30231%20%2F%2030506-30507%20%2F%2042031-42033%20%2F%204900-49002%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CFONT%20size%3D%222%22%3EAudit%20-%20All%20User%20Object%20Actions%3C%2FFONT%3E%3C%2FTD%3E%0A%3CTD%20width%3D%22539%22%3E%3CFONT%20size%3D%222%22%3EMessage%20IDs%3A%2030600-30606%3C%2FFONT%3E%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CH3%20id%3D%22toc-hId--522853952%22%20id%3D%22toc-hId--522853952%22%3E%26nbsp%3B%3C%2FH3%3E%0A%3CH3%20id%3D%22toc-hId-1219956383%22%20id%3D%22toc-hId-1219956383%22%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%3B%22%3E%3CSTRONG%3EScript%20to%20Import%20Status%20Message%20Queries%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22powershell%22%20style%3D%22padding-left%3A%2020px%3B%22%3E%3CSPAN%20class%3D%22powerShell__keyword%22%3Eparam%3C%2FSPAN%3E(%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%5BParameter(Mandatory%3D%3CSPAN%20class%3D%22powerShell__variable%22%3E%24True%3C%2FSPAN%3E)%5D%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%5Bstring%5D%3CSPAN%20class%3D%22powerShell__variable%22%3E%24XMLPath%3C%2FSPAN%3E%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E)%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__com%22%3E%23%26nbsp%3BImports%26nbsp%3BConfigMgr%26nbsp%3BModule%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3EImport%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EModule%26nbsp%3B%3CSPAN%20class%3D%22powerShell__string%22%3E%22%24env%3ASMS_ADMIN_UI_PATH%5C..%5CConfigurationManager.psd1%22%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__com%22%3E%23%26nbsp%3BGet%26nbsp%3BSiteCode%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__variable%22%3E%24SiteCode%3C%2FSPAN%3E%26nbsp%3B%3D%26nbsp%3B%3CSPAN%20class%3D%22powerShell__cmdlets%22%3EGet-PSDrive%3C%2FSPAN%3E%26nbsp%3B%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EPSProvider%26nbsp%3BCMSITE%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__cmdlets%22%3ESet-location%3C%2FSPAN%3E%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24SiteCode%3C%2FSPAN%3E%3CSPAN%20class%3D%22powerShell__string%22%3E%22%3A%22%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__com%22%3E%23%26nbsp%3BImports%26nbsp%3BXML%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__keyword%22%3ETry%3C%2FSPAN%3E%26nbsp%3B%7B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24CMStatusMsgs%3C%2FSPAN%3E%26nbsp%3B%3D%26nbsp%3B%3CSPAN%20class%3D%22powerShell__cmdlets%22%3EImport-Clixml%3C%2FSPAN%3E%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24XMLPath%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%7D%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__keyword%22%3ECatch%3C%2FSPAN%3E%26nbsp%3B%7B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BWrite%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EHost%26nbsp%3B%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EForegroundColor%26nbsp%3BRed%26nbsp%3B%3CSPAN%20class%3D%22powerShell__string%22%3E%22Invalid%26nbsp%3Bfile%26nbsp%3Bpath%26nbsp%3Bor%26nbsp%3Bfile%26nbsp%3Btype.%26nbsp%3B%26nbsp%3BPlease%26nbsp%3Btry%26nbsp%3Bagain.%22%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22powerShell__keyword%22%3EExit%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%7D%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22powerShell__keyword%22%3Eforeach%3C%2FSPAN%3E%26nbsp%3B(%3CSPAN%20class%3D%22powerShell__variable%22%3E%24Query%3C%2FSPAN%3E%26nbsp%3B%3CSPAN%20class%3D%22powerShell__keyword%22%3Ein%3C%2FSPAN%3E%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24CMStatusMsgs%3C%2FSPAN%3E)%26nbsp%3B%7B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22powerShell__keyword%22%3ETry%3C%2FSPAN%3E%26nbsp%3B%7B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24StatusQuery%3C%2FSPAN%3E%26nbsp%3B%3D%26nbsp%3B%40%7B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BName%26nbsp%3B%3D%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24Query%3C%2FSPAN%3E.Name%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BExpression%26nbsp%3B%3D%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24Query%3C%2FSPAN%3E.Expression%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BComments%26nbsp%3B%3D%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24Query%3C%2FSPAN%3E.Comments%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BNew%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3ECMStatusMessageQuery%26nbsp%3B%40StatusQuery%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BWrite%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EHost%26nbsp%3B%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EForegroundColor%26nbsp%3BGreen%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24Query%3C%2FSPAN%3E.Name%26nbsp%3B%3CSPAN%20class%3D%22powerShell__string%22%3E%22was%26nbsp%3Bcreated%26nbsp%3Bsuccessfully.%22%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22powerShell__keyword%22%3ECatch%3C%2FSPAN%3E%26nbsp%3B%7B%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BWrite%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EHost%26nbsp%3B%3CSPAN%20class%3D%22powerShell__operator%22%3E-%3C%2FSPAN%3EForegroundColor%26nbsp%3BRed%26nbsp%3B%3CSPAN%20class%3D%22powerShell__variable%22%3E%24Query%3C%2FSPAN%3E.Name%26nbsp%3B%3CSPAN%20class%3D%22powerShell__string%22%3E%22already%26nbsp%3Bexists.%22%3C%2FSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%3CBR%20%2F%3E%7D%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1332200578%22%20id%3D%22toc-hId--1332200578%22%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%3B%22%3E%20%3CSTRONG%3E%20Export%20Status%20Message%20Queries%20to%20XML%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhat%20if%20you%20wish%20to%20export%20your%20own%20Status%20Message%20Queries%20to%20another%20environment%3F%26nbsp%3B%20You%20can%20leverage%20the%20ConfigMgr%20PowerShell%20cmdlets%3A%20%3CSTRONG%3E%20Get-CMStatusMessageQuery%20%3C%2FSTRONG%3E%20and%20%3CSTRONG%3E%20Export-Clixml%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH5%20id%3D%22toc-hId-1111674335%22%20id%3D%22toc-hId-1111674335%22%3E%20%20%3CSTRONG%3E%3CEM%3ENOTE%3A%20%3C%2FEM%3E%20%3C%2FSTRONG%3E%20%3CEM%3E%20Requires%20the%20ConfigMgr%20PowerShell%20Module%3C%2FEM%3E%3C%2FH5%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%3CEM%3EExport%20all%20Queries%3C%2FEM%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EGet-CMStatusMessageQuery%20%7C%20Export-Clixml%20%26lt%3Bpath%26gt%3B%5CStatusMsgQueries.xml%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22text-decoration%3A%20underline%3B%22%3E%3CEM%3EExport%20only%20Queries%20beginning%20with%20the%20name%20%E2%80%9CAudit%E2%80%9D%3C%2FEM%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EGet-CMStatusMessageQuery%20-Name%20Audit*%20%7C%20Export-Clixml%20%26lt%3Bpath%26gt%3B%5CAudit_StatusMsgQueries.xml%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EReferences%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fconfigurationmanager%2Fget-cmstatusmessagequery%3Fview%3Dsccm-ps%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Get-CMStatusMessageQuery%2C%20%3C%2FA%3E%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fmicrosoft.powershell.utility%2Fexport-clixml%3Fview%3Dpowershell-6%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Export-Clixml%20%3C%2FA%3E%20%3CBR%20%2F%3E%3CBR%20%2F%3EI%20hope%20this%20information%20will%20help%20you%20in%20becoming%20a%20true%20detective%20within%20your%20environment.%26nbsp%3B%20Very%20special%20thanks%20for%20%3CSTRONG%3E%20SaudM%20%3C%2FSTRONG%3E%20on%20the%20%E2%80%9C%3CSTRONG%3EEnumerating%20Status%20Message%20Strings%3C%2FSTRONG%3E%E2%80%9D%20script%20along%20with%20%3CSTRONG%3E%20Kevin%20Kasalonis%20%3C%2FSTRONG%3E%20on%20his%20assistance%20with%20the%20content%20of%20this%20blog.%20%3CBR%20%2F%3E%3CBR%20%2F%3EThank%20you%20again%20for%20reading!%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3E%20Brandon%20McMillan%2C%20Premier%20Field%20Engineer%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3E%20Disclaimer%3A%20%3C%2FSTRONG%3E%20%3CSPAN%3E%20The%20information%20on%20this%20site%20is%20provided%20%E2%80%9CAS%20IS%E2%80%9D%20with%20no%20warranties%2C%20confers%20no%20rights%2C%20and%20is%20not%20supported%20by%20the%20authors%20or%20Microsoft%20Corporation.%20Use%20of%20any%20included%20script%20samples%20are%20subject%20to%20the%20terms%20specified%20in%20the%20%3C%2FSPAN%3E%20%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Flegal%2Fintellectualproperty%2Fcopyright%2Fdefault.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Terms%20of%20Use%3C%2FA%3E%3CSPAN%3E.%20%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-884897%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20published%20on%20TECHNET%20on%20Mar%2018%2C%202019%3C%2FP%3E%0A%3CP%3EHello%20everyone!%26nbsp%3B%20I%20have%20found%20that%20Status%20Message%20Queries%20can%20be%20one%20of%20the%20more%20underappreciated%20features%20of%20ConfigMgr.%26nbsp%3B%20The%20information%20you%20can%20gather%20in%20a%20quick%20and%20easy%20query%20can%20be%20very%20powerful%20in%20helping%20you%20determine%20the%20root%20cause%20analysis%20of%20an%20issue.%26nbsp%3B%20I%20hope%20this%20blog%20will%20provide%20you%20with%20additional%20Status%20Message%20Queries%20and%20how%20you%20can%20quickly%20export%2Fimport%20some%20examples%20into%20your%20environment.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-884897%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EBrandonMcMillan%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E

First published on TECHNET on Mar 18, 2019

Authored by Brandon McMillan


Hello everyone!  My name is Brandon McMillan and I am a System Center Configuration Manager (ConfigMgr) PFE.  I have found that Status Message Queries can be one of the more underappreciated features of ConfigMgr.  The information you can gather in a quick and easy query can be very powerful in helping you determine the root cause analysis of an issue.  I hope this blog will provide you with additional Status Message Queries and how you can quickly export/import some examples into your environment.

First let’s break down the different Status Message Types:

 


ID

Status Message Type

Description

256

Milestones
Use this type at the end of an operation to indicate the operation's success or failure. If the operation was successful, use the Milestone type in an informational message. If the operation failed, use a milestone message type in a warning or error message.

512

Details
Use this type to illustrate the steps in a complex operation. Often, detail messages are meaningful only within the context of the sequence of status messages representing a complex operation.

768

Audits
Use this type for informational messages that provides a trail of actions taken by the Configuration Manager administrator. An audit message also depicts an operation that results in objects being added, modified, or deleted. You do not need to create audit messages; the provider automatically generates these messages for you.

1024

NT Events
 


Reference: SMS_StatusMessage WMI Class

Here is a quick overview of Status Message Queries:

 


Status Message Queries
Use this node to query status messages for specific events and related details. You can use status message queries to find the status messages related to specific events.
You can often use status message queries to identify when a specific component, operation, or Configuration Manager object was modified, and the account that was used to make the modification. For example, you can run the built-in query for Collections Created, Modified, or Deleted to identify when a specific collection was created, and the user account used to create the collection.


Reference: Use Alerts and the Status System

 

Enumerating Status Message Strings


How can we obtain a full listing of Status Message ID’s?  If you are unsure what Status Message ID’s to use to create a specific Status Message Query, you can export all the Status Messages ConfigMgr provides by using a PowerShell script from an article by SaudM .  The script and an example of an excel output from a ConfigMgr 2012 R2 environment can be found here: Enumerate Status Messages.


Here’s an example of how you can leverage the script and export the Status Messages based on type: Client, Provider, or Server Messages.

 

Client Messages

 

.\Export-StatusMessages.ps1 -stringPathToDLL "<InstallDrive>:\Program Files\Microsoft Configuration Manager\bin\X64\system32\smsmsgs\climsgs.dll" -stringOutputCSV ExportClientMsgs.csv

 

Provider Messages

 

.\Export-StatusMessages.ps1 -stringPathToDLL "<InstallDrive>:\Program Files\Microsoft Configuration Manager\bin\X64\system32\smsmsgs\provmsgs.dll" -stringOutputCSV ExportProviderMsgs.csv

 

Server Messages

 

.\Export-StatusMessages.ps1 -stringPathToDLL "<InstallDrive>:\Program Files\Microsoft Configuration Manager\bin\X64\system32\smsmsgs\srvmsgs.dll" -stringOutputCSV ExportServerMsgs.csv

 

Default Status Message Queries

 

We provide many out of box queries that are delivered with the product; however, there are many Message ID’s that you can leverage which could help you build your own specific queries for your environment. Some of the default Status Message Queries you may already be familiar with are below:

 

Query Title Query Details
All Audit Status Messages for a Specific User Message Type: 768
Message Attribute ID: 403
All Audit Status Messages from a Specific Site Message Type: 768
Boundaries Created, Modified, or Deleted Message IDs: 40600-40602
Client Component Configuration Changes Message IDs: 30042-30047
Collections Created, Modified, or Deleted Message IDs: 30015-30017
Collection Member Resources Manually Deleted Message IDs: 30066-30067
Deployments Created, Modified, or Deleted Message IDs: 30006-30008
Packages Created, Modified, or Deleted Includes Package Conversion Status
Message IDs: 30000-30002
Programs Created, Modified, or Deleted Includes Package Conversion Status
Message IDs: 30003-30005
Queries Created, Modified, or Deleted Message IDs: 30063-30065
Remote Control Activity at a Specific Site, User, or System (4 Total) Message IDs: 30069-30087
Security Scopes Created, Modified, Deleted, or Imported Message IDs: 31200-31202 / 31220-31222 / 31207
Server Component Configuration Changes Message IDs: 30033-30035 / 30039-30041
Site Control Changes
Site Addresses Created, Modified, or Deleted Message IDs: 30018-30020

 

Enhanced Audit Status Message Queries

 

Now what if you need something more specific?  The following list may help you quickly determine what specific activities are occurring within your environment.  A direct link to TechNet gallery of the exported Status Message Queries is located here: Enhanced Audit Status Message Queries .  This was last updated from a ConfigMgr version 1810 environment.

 

Query Title Query Details
Audit - All Alert Actions Includes DRS Alerts
Message IDs: 30240-30244
Audit - All Application Actions Message IDs: 30226-30228 / 49003-49005 / 52300
Audit - All Application Catalog Actions Message IDs: 30800-30805 / 50000-50004
Audit - All Asset Intelligence Actions Message IDs: 30208-30209 / 31001
Audit - All Azure and Co-Management Actions Message IDs: 53001-53005 / 53401-53403 / 53501-53503
Audit - All Boundary Group Actions Message IDs: 40500-40505
Audit - All Client and Collection Miscellaneous Actions Includes Update Membership, Device Imports, Clear PXE Deployments
Message IDs: 30104 / 30213 / 42021
Audit - All Client Configuration Requests (CCRs) Client Push actions.
Message IDs: 30106-30111
Audit - All Client Operations Actions Includes “Right Click” actions.
Message IDs: 40800-40804
Audit - All Client Settings Actions Includes Antimalware Policies.
Message IDs: 40300-40305
Audit - All CMPivot and Script Actions Message IDs: 40805-40806 / 52500-52505
Audit - All Conditional Access Actions Includes Exchange Online, SharePoint Online, and On-Prem Exchange actions.
Message IDs: 30340-30341
Audit - All ConfigMgr Actions in Console Checks components: Microsoft.ConfigurationManagement.exe / AdminUI.PS.Provider.dll
Audit - All Configuration Baseline Actions Message IDs: 30168 / 30193-30198
Audit - All Configuration Items Includes Compliance Settings and Endpoint Protection policy actions.
Message IDs: 30152-30167
Audit - All Content Library Actions Includes Content Library changes
Message IDs: 30080 / 30189-30191
Audit - All Distribution Point Actions Message IDs: 30009-30011 / 30068 / 30109 / 30125 / 30500-30503 / 40409-40410
Audit - All Distribution Point Changes Message IDs: 40400-40409 / 40506
Audit - All Folder Actions Message IDs: 30113-30117
Audit - All Messages  
Audit - All Messages (Specified Message ID)  
Audit - All Messages (Specified Timeline)  
Audit - All Migration Actions Message IDs: 30900-30907
Audit - All Mobile Device Management Actions Message IDs: 40200-40206 / 45000-45004 / 47000-47002 / 48000-48003 / 49003-49005 / 51000-51006 / 52000-52020
Audit - All Phased Deployment Actions Message IDs: 53601-53603
Audit - All Query Actions Message IDs: 30063-30065 / 30302-30303
Audit - All Report Actions Message IDs: 30091-30093 / 31000-31002
Audit - All Search Folder Actions Message IDs: 30700-30702
Audit - All Secondary Site Actions Message IDs: 30012-30014 / 30021-30023
Audit - All Site Server Boundary Actions Message IDs: 30054-30056
Audit - All Site Server Definition Actions Message IDs: 30030-30032
Audit - All Site Server Property Actions Message IDs: 30024-30029
Audit - All Site Server Role Actions Message IDs: 30036-30038
Audit - All Site Server Security Actions Message IDs: 30057-30062 / 30210-30212 / 31200-31242 / 31203-31249
Audit - All Site Server SQL Actions Includes Site Maintenance Tasks
Message IDs: 30048-30053
Audit - All Software Metering Rules Actions Message IDs: 30094-30095 / 30105
Audit - All Software Update Actions Message IDs: 30112 / 30118-30124 / 30135-30137 / 30172 / 30183-30188 / 30196-30198 / 30219-30221 / 30229-30231 / 30506-30507 / 42031-42033 / 4900-49002
Audit - All User Object Actions Message IDs: 30600-30606

 

Script to Import Status Message Queries

 

param(  
    [Parameter(Mandatory=$True)]  
    [string]$XMLPath  
)  
  
# Imports ConfigMgr Module 
Import-Module "$env:SMS_ADMIN_UI_PATH\..\ConfigurationManager.psd1" 
 
# Get SiteCode 
$SiteCode = Get-PSDrive -PSProvider CMSITE 
Set-location $SiteCode":" 
 
# Imports XML 
Try { 
    $CMStatusMsgs = Import-Clixml $XMLPath 

Catch { 
    Write-Host -ForegroundColor Red "Invalid file path or file type.  Please try again." 
    Exit 

 
foreach ($Query in $CMStatusMsgs) { 
      Try {   
           $StatusQuery = @{ 
                Name = $Query.Name 
                Expression = $Query.Expression 
                Comments = $Query.Comments   
            } 
            New-CMStatusMessageQuery @StatusQuery 
            Write-Host -ForegroundColor Green $Query.Name "was created successfully." 
      }  
      Catch { 
            Write-Host -ForegroundColor Red $Query.Name "already exists." 
      }       
}

 

Export Status Message Queries to XML

 

What if you wish to export your own Status Message Queries to another environment?  You can leverage the ConfigMgr PowerShell cmdlets: Get-CMStatusMessageQuery and Export-Clixml.

 

NOTE: Requires the ConfigMgr PowerShell Module

 

Export all Queries

 

Get-CMStatusMessageQuery | Export-Clixml <path>\StatusMsgQueries.xml

 

Export only Queries beginning with the name “Audit”

 

Get-CMStatusMessageQuery -Name Audit* | Export-Clixml <path>\Audit_StatusMsgQueries.xml

 

References: Get-CMStatusMessageQuery, Export-Clixml

I hope this information will help you in becoming a true detective within your environment.  Very special thanks for SaudM on the “Enumerating Status Message Strings” script along with Kevin Kasalonis on his assistance with the content of this blog.

Thank you again for reading!

Brandon McMillan, Premier Field Engineer

Disclaimer: The information on this site is provided “AS IS” with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of any included script samples are subject to the terms specified in the Terms of Use.