Audit reports are empty for events that have a computer account as the acting user (4243082)

サポートと今すぐチャット

戻る

フィードバックを送信しました

この記事は課題解決に役立ちましたか?

評価を選択

タイトル

Audit reports are empty for events that have a computer account as the acting user
説明

Trying to run a report for events where a computer account is the acting user, results in no data returned. For example, the User Accounts Created report does not show any events for when a user was created using the Exchange Management Console or Exchange Control Panel.
対策
The Audit reports are configured by default to exclude Computer accounts from the Acting Users Filter. The Audit reports filter will need to be modified to not exclude Computer accounts.

For example, when an account is created in Exchange, the account is created under the context of the Exchange computer account. The User Account Created report would need to be modified as follows:
1. Expand Auditing & Alerting
2. Click Audit Reports
3. Right click User Accounts Created and select More | Copy As
  
  Note: It is Best Practice to make a copy of a canned report and modify the copy instead of the original
4. Provide a name for the new report
5. Right click the new report and select Edit
6. Click Report Filters
7. Ensure User Account Created is listed under Events
8. Set the Date filter to the range you want to use by clicking the gear icon
9. Click Add Filter | Acting Users Filter
10. Uncheck Exclude Computer Accounts
11. Click OK
12. Click OK

フィードバックを送信しました

この記事は課題解決に役立ちましたか?

評価を選択

推奨コンテンツ

タイトル