Changes to mailbox permissions are logged with Computer$ as the WHO (4240881)

When modifying permissions on a mailbox that has been created but not logged into, or has not received a message, the WHO of the event shows as the logged in user. Once the mailbox is active, however, subsequent events are reported as performed by Computer$.

This is how Microsoft logs the event natively. The actual work is done by the Local System.

We are reporting a correct value, but not what is expected or desired by the customer for these events.

The ability to associate the logged on user with the event has been submitted as an enhancement request.