Exchange Server name instead of User in reports

KB1891 | Last review: Mar 27, 2014 | Netwrix Auditor for Exchange, Netwrix Auditor for Active Directory | 5.0 and above
Email It to Me Print this Page
Symptoms Netwrix Auditor report shows Exchange server name instead of user name in the Who changed column for group membership changes:
Modifiedgroup2/27/2014 3:51:36 PMDMC\EX13$DC.dmc.locunknown\loc\dmc\Users\limboDistribution Universal Group Member: Removed: "dmc.loc/Users/Smith"
Distribution Universal Group Member: Added: "dmc.loc/Users/Wilson"
Cause This happens because the default Exchange 2013 Administrator Audit Log parameter LogLevel is set to None, and the CmdletName, ObjectName, Parameters (values), and the Caller, Succeeded, and RunDate properties are included in log entries.
But the data required to show correct Who changed is missing because ModifiedProperties (old and new) and ModifiedObjectResolvedName properties are NOT included in the log entries.
Resolution In order to solve this issue, the LogLevel parameter should be changed from None to Verbose to provide ModifiedProperties (old and new) and ModifiedObjectResolvedName properties. To enable the parameter please run the following cmdlet with Exchange Management Shell:

Set-AdminAuditLogConfig -LogLevel Verbose

The output should be like this:
[PS] C:\Windows\system32>Set-AdminAuditLogConfig -LogLevel Verbose
WARNING: The admin audit log configuration change you specified could take up to 60 minutes to take effect.

After that please run the Get-AdminAuditLogConfig cmdlet and check that LogLevel is set to verbose now:

LogLevel                     : Verbose
Was this information helpful?