The Audit reports are configured by default to exclude Computer accounts from the Acting Users Filter. The Audit reports filter will need to be modified to not exclude Computer accounts.
For example, when an account is created in Exchange, the account is created under the context of the Exchange computer account. The User Account Created report would need to be modified as follows:
- Expand Auditing & Alerting
- Click Audit Reports
- Right click User Accounts Created and select More | Copy As
Note: It is Best Practice to make a copy of a canned report and modify the copy instead of the original - Provide a name for the new report
- Right click the new report and select Edit
- Click Report Filters
- Ensure User Account Created is listed under Events
- Set the Date filter to the range you want to use by clicking the gear icon
- Click Add Filter | Acting Users Filter
- Uncheck Exclude Computer Accounts
- Click OK
- Click OK
