We have been locking down the tasks that users can do in SCOM. Is there a report we can look at that would show us who ran a task. Example who triggered a restart of IIS app pool?
If I recall correctly, this is only stored in the OpsDB. You could always create a SCOM Agent Task to run:
Against a management server and throw it on a perspective.
I think you’d need to do some PS magic to get the task name to display, so perhaps this is something to run against the OpsDB in a SQL tile? You could export this from SquaredUp too.