Regresar
-
Título
Audit reports are empty for events that have a computer account as the acting user -
Descripción
Trying to run a report for events where a computer account is the acting user, results in no data returned. For example, the User Accounts Created report does not show any events for when a user was created using the Exchange Management Console or Exchange Control Panel. -
Resolución
The Audit reports are configured by default to exclude Computer accounts from the Acting Users Filter. The Audit reports filter will need to be modified to not exclude Computer accounts.For example, when an account is created in Exchange, the account is created under the context of the Exchange computer account. The User Account Created report would need to be modified as follows:- Expand Auditing & Alerting
- Click Audit Reports
- Right click User Accounts Created and select More | Copy As
Note: It is Best Practice to make a copy of a canned report and modify the copy instead of the original - Provide a name for the new report
- Right click the new report and select Edit
- Click Report Filters
- Ensure User Account Created is listed under Events
- Set the Date filter to the range you want to use by clicking the gear icon
- Click Add Filter | Acting Users Filter
- Uncheck Exclude Computer Accounts
- Click OK
- Click OK