Return
-
Title
Initiator field is blank for events with a source of Change Auditor -
Description
When an active directory group's membership is modified, the change auditor alert's initiator filed is blank if the source if Change Auditor. -
Resolution
To identify when the initiator field is blank for events with a source of Change Auditor, the following parameters are to be considered:- The initiator field is only valid when the event source is Active Roles Server or GPOAdmin.
- There is no initiator data when the event is generated by Change Auditor.
- The Who value is the account that performed the action.