This information is based on Microsoft’s beta release of System Center Configuration Manager Service Pack 2 and is subject to change.

Within the SCCM SP2 beta, Microsoft has included support for AMT Audit Log.  Audit Log was introduced in AMT version 4 and provides a mechanism to captures the occurrence of significant AMT events and who performed those actions.

Before you begin, you must configure SCCM SP2 on which AMT Audit Log events it turns on.  This can be done by selecting Out of Band Management properties under "Site Database" -> "Site Management" -> <Site Code> -> "Site Settings" -> "Component Configuration" -> “Audit Setting” Tab.

 

AuditLog-Settings.jpg

Unlike other AMT feature enablement with SCCM, Audit log is not enabled during Provisioning or through the Update Management Controller process; it must be performed as a post provisioning step.  To enable the AMT Audit log, you must right click on the AMT client and select “Out of Band Management” -> “Enable Auditing and Apply Audit Log Settings”.  You can also disable and clear the audit log from this menu as well.

 

AuditLog-Enable.jpg

Once enabled on the AMT Client, you can access the AMT Audit Log through the Out of Band Management Console available through right clicking on the AMT client and select “Out of Band Management” -> “Out of Band Management Console”.

AuditLog-OOBC.jpg

 

--Matt Royer