Following below scenario the Symantec Management Agent doesn't log which user was logged in and executed patching cycle:
1. "Allow user to run" option selected on the "Default Software Update Plug-in Policy" located in the ITMS console under menu Settings > Agents/Plug-ins > Software > Patch Management > Windows.
2. User logged on to managed machine clicked on the "Start Software Update Cycle" from the "Symantec Management Agent GUI > Software Updates tab".
< 8.1
The information regarding what user clicked "Start Software Update Cycle", is not collected in the Symantec Management Agent logs before the ITMS 8.1 version
Recording the user ID of the individual who clicked "Start Software Update Cycle" is included with ITMS 8.1 GA product version.
The attached screenshot present how the collected information looks in the Symantec Management Agent logs.