SEP Client Grouping History

Hello all,

One of our clients are moving from a group to the default group. I've read across most articles, and suspect that the reason why it jumps back to default group is due to hardware device ID, due to reimaging the OS with SEP installed prior. Anyway, I am curious as to whether there is a client log file where we can see where a particular client is moved to, which group, and by whom (which administrator). If so, where can I export the file from? It does not matter if the log file contains other information, I just need to it for troubleshooting.

Thanks!