Exchange Server name instead of User in reports
Save PDF
Share
Feedback
- Last UpdatedApr 01, 2020
- 1 minute read
Netwrix Auditor report shows Exchange server name instead of user name in the Who changed column for group membership changes.
This happens because by default LogLevel parameter of the Administrator Audit Log is set to None, and the
In order to solve this issue, the LogLevel parameter should be changed from None to Verbose to provide
The output should be like this:
[PS] C:Windowssystem32>Set-AdminAuditLogConfig -LogLevel Verbose WARNING: The admin audit log configuration change you specified could take up to 60 minutes to take effect.
After that run the Get-AdminAuditLogConfig cmdlet and check that LogLevel is set to verbose now:
LogLevel : Verbose
This happens because by default LogLevel parameter of the Administrator Audit Log is set to None, and the
CmdletName, ObjectName, Parameters (values), and the Caller, Succeeded, and RunDate properties are included in log entries. But the data required to show correct Who changed is missing because ModifiedProperties (old and new) and ModifiedObjectResolvedName properties are NOT included in the log entries.
In order to solve this issue, the LogLevel parameter should be changed from None to Verbose to provide
ModifiedProperties (old and new) and ModifiedObjectResolvedName properties. To enable the parameter, run the following cmdlet with Exchange Management Shell: Set-AdminAuditLogConfig -LogLevel VerboseThe output should be like this:
[PS] C:Windowssystem32>Set-AdminAuditLogConfig -LogLevel Verbose WARNING: The admin audit log configuration change you specified could take up to 60 minutes to take effect.
After that run the Get-AdminAuditLogConfig cmdlet and check that LogLevel is set to verbose now:
LogLevel : Verbose