Return
-
Title
Exchange events showing the Exchange server as the account making the change instead of the user account that performed the change -
Description
Exchange events are showing the Exchange server for the “Who” value instead of the user that made the change on the Exchange server.
-
Cause
Change Auditor agents are either missing, inactive or the agent can't modify the ScriptingAgentConfig file on the Exchange Server(s). -
Resolution
Starting with Exchange 2010, Microsoft® re-architected how they process configuration changes. Therefore, in order for Change Auditor to retrieve the correct ‘who’ information for these Active Directory based events, Change Auditor audits Windows PowerShell directly on the Exchange Server. This requires a Change Auditor agent to installed on the Exchange server(s) and a Change Auditor for Exchange license.Deploy a Change Auditor agent to all Exchange 2010/2013/2016 servers (or ensure that they are active if they already exist). However, duplicate events will be generated for Exchange 2010/2013/2016 Active Directory events: one from the agent auditing attribute changes on a domain controller (contains no ‘who’ value) and one from the new agent auditing PowerShell on an Exchange server (contains the correct ‘who’ value).
Exchange 2010/2013/2016 - Deploy agents to all Exchange Servers. When a Change Auditor 5.6 (or higher) agent is deployed on Exchange Server 2010/2013/2016, it automatically enables the scripting extension in Active Directory. This is a domain-wide setting and applies to ALL Exchange 2010/2013 servers. This extension requires that the ScriptingAgentConfig.xml file be present in the Exchange Server folder; otherwise, Exchange management tools will display error messages each time the Scripting Agent cmdlet runs. The Change Auditor 5.6 (or higher) agent automatically creates the required ScriptingAgentConfig.xml file in the Exchange Server folder if one is not already present. Therefore, it is highly recommended that a Change Auditor agent be installed on ALL Exchange servers to ensure all servers are using the same scripting agent.If there is an agent on all Exchange servers and they are confirmed to be active and working, also ensure the Exchange version (and applied rollup or update) is supported by the version of Change Auditor you are using. Please see the Change Auditor Release Notes to confirm.