Lock Computer - Is there a log file for this command?

[elund]

A MacBook was locked down yesterday, but no one in our office pushed that command out. Is there a log file somewhere in the JSS that would show the user that sent that command out? I have not been able to locate any logs regarding this.

[rdwhitt]

If you have change management enabled in the JSS system settings, you can search the changemanagement.log on the JSS. We're on RHEL so it's located at /usr/local/jss/logs/JAMFChangeManagement.log. You'll be looking for the "Computer Remote Lock Command" and the id of the computer, which you can get from the URL when viewing the computer record.

We offload our change management logs to Graylog which makes searching for something like this a snap.

[elund]

Thank you for that info! I'll take a look there!