i don't believe there's any way to do this with the jss. the closest you get with the policies table in the db is a "created_by" column, which probably isn't going to help you.

logging and auditing in casper are poorly implemented.

maybe someone else can chime in here with other feedback.

Does your JSS Change Management Log not contain this information? See Settings > General Settings > Change Management to see if the log is enabled and where the log file is stored.

i stand corrected. the "change management" log will give you basically raw sql statements, timestamps, and who made the change. it's better than nothing but still kinda crappy.

Yep, it's hard to slog through, but you can certainly find the offender :)

I have it enabled but the file has not been updated since May. What am I missing???

This is a Windows JSS, btw.

Yikes, I had left the path to the default, which is the OS X server path. Grumble, grumble. It's amazing to me that the Windows installer for the JSS does not set this to a Windows path.

I won't know by the log but at least I know for the future.