Desired Configuration - Remediation Client Log
Currently, there is no client logging when a Configuration Item is remediated. This is all that there is:
1) An entry in CIAgent.log:
"Invocation succeeded for policy platform job <GUID>"
2) 2 entries in %PROGRAMFILES%\Microsoft Policy Platform\PolicyPlatformClient.log:
"Starting job [<GUID>] with the following parameters"
"Mode = Remediate, JobPriority = Foreground, PrincipalId = [SYSTEM], ScopeFilters = # filter[s]"
The other other place that there's evidence of remediation are in the Baseline reports on the client and the SSRS reports on the server.
None of these locations show any detail about when individual configuration items were remediated. I recently had to troubleshoot a registry key that was changing & had a very difficult time trying to determine A) if the cause was SCCM Compliance Remediation and B) which Baseline/Item was the cause.
