A MacBook was locked down yesterday, but no one in our office pushed that command out. Is there a log file somewhere in the JSS that would show the user that sent that command out? I have not been able to locate any logs regarding this.
+7If you have change management enabled in the JSS system settings, you can search the changemanagement.log on the JSS. We're on RHEL so it's located at /usr/local/jss/logs/JAMFChangeManagement.log. You'll be looking for the "Computer Remote Lock Command" and the id of the computer, which you can get from the URL when viewing the computer record.
We offload our change management logs to Graylog which makes searching for something like this a snap.
Reply
Most helpful members this week
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.