How can I tell who created a Hyper-V guest after the fact?

Question

I have a situation where I have Hyper-V Servers being created on a customer's system.

Is there any way I can find out who created them?

I realise anybody could get hold of the Administrator account details, but I have several different accounts that could have created them.

I have seen articles on VMWare: http://www.virtu-al.net/2010/02/23/who-created-that-vm/ but nothing on Hyper-V. Any help would be appreciated.

do you mean guests not hv servers? If so then nothing is audited other then maybe a causual relationship between guest install times and hv host server security logs. But thats going to be almost worthless! Not sure if configuing azman will improve this or not.
Yes you are quite right I did mean guests. You are saying what I feared and there may be no way to trace the owner/creator.

Chopper3 · Answer 1 · 2010-11-19 17:00:37Z

up vote 0 down vote

Logs, look at them.

answered Nov 19 '10 at 17:00

Chopper3
58.3k549125

	If you can. Likely the info has already been retired in the logs - too old. – TomTom Nov 19 '10 at 18:17
	How can you say that, we have literally no idea when this happened or the size of their logs. – Chopper3 Nov 19 '10 at 19:22

feedback

1 Answer