How to Search for events where the user object attribute value is <Not set> in the "To:" field (4250481)

Administrators may want to search for Change Auditor events where the Active Directory user attribute value is in the "To:" field, indicating that the attribute was populated but had been deleted or cleared.

1. Click on the What tab of the Search
2. Click the drop arrow next to the "Add" button and select "Subsystem | Active Directory..."
3. Under Actions, ensure only "Delete Attribute" is checked * Do not change the "Scope" or "All Transports".
4. Click OK
5. On the What tab of the Search, click the drop arrow next to the "Add" button and select "Event Class".
6. Locate the and select the Event Class "Last name changed on user object".
7. Click the "Add" button and click OK
8. Save and Run the Search