There has been some confusion between the who and what tabs. This is to clarify the main difference
The who tab is used to do a search for who has made the change. An example would be "I want to see all the changes the Administrator account has done" so you would add the administrator account to the who tab and see this.
You could further filter this by adding additional event classes to the what tab. For example, "I want to see all the users added to a group by the administrator account". You would add administrator to who and the event class for group member added.
The What tab is used to see what has happened to the object. For example, "I want to see all changes to the Administrator account". Here you would add the administrator account to the What tab using the Subsystem for Active Directory.
You could filter this further by adding additional event classes and/or objects to it. For example, "I want to see all group changes of the administrator account". Here you would add the administrator account and the event class for the group change under the What tab.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center