Error: “Your default domain audit settings may prevent the ‘Who Changed’ field from being reported correctly”

Active Directory
6.5 and older
7.0-8.5
9.0-9.7
9.8
https://kb.netwrix.com/1250
Copy Article URL Copied
  • The Change Summary and the Netwrix Auditor System Health log contain the following warning message: “Your default domain audit settings may prevent the ‘Who Changed‘  field from being reported correctly”.
  • Who Changed” field contains the “System” value.

Object-level Active Directory auditing settings are not configured for monitoring all possible changes made to Active Directory by any user. Therefore, product reports can contain the “System” value as a source of changes instead of an account name.

To monitor all possible changes made to Active Directory by any user, you must make sure that your Active Directory auditing settings are configured properly. Please follow instructions provided in this artice: https://helpcenter.netwrix.com/Configure_IT_Infrastructure/AD/AD_Object_Level.html#Proc_ObjectLevel_DomainPartition

Go Up