Events of Domain accounts created on Exchange servers are not displayed on the Audit Report (4378455)

Events related to the creation of Domain accounts on Exchange servers are not displayed on the Audit Report 

However, domain accounts created directly in Active Directory (AD) are shown correctly. 

This issue is caused by the filtering settings in the audit reports.

When a domain account is created, the acting user recorded in the event is typically the user who created the AD account.

However, when a domain account is created on an Exchange server, the acting user is recorded as the Exchange server itself, rather than the user who initiated the creation of the account.

By default, AA’s audit reports have the "Exclude computer accounts" option enabled in the "Acting Users" report section to filter out unnecessary events. However, for this specific scenario, disabling this option is necessary to ensure these events are captured correctly.

Workaround:

1. Create a new audit report.
2. Uncheck the "Exclude computer accounts" option in the "Acting Users" report filter.
3. Select the "User Account Created" event in the "Events" report filter.
4. Customize the report further as needed using additional filters.