@Dashrender said in Tracking the origination of a shadow copy:

I suppose you could easy enough with an agent, thinking backups here.

Precisely. As the origination is the same machine and not the backup device, I guess that answers that.