Exchange Server name instead of User in reports

Active Directory
6.5 and older
Copy Article URL Copied

Netwrix Auditor report shows Exchange server name instead of user name in the Who changed column for group membership changes:

Modified group 2/27/2014 3:51:36 PM DMC\EX13$ DC.dmc.loc unknown \loc\dmc\Users\limbo Distribution Universal Group Member: Removed: “dmc.loc/Users/Smith”
Distribution Universal Group Member: Added: “dmc.loc/Users/Wilson”

This happens because the default Exchange 2013 Administrator Audit Log parameter LogLevel is set to None, and the CmdletName, ObjectName, Parameters (values), and the Caller, Succeeded, and RunDate properties are included in log entries.
But the data required to show correct Who changed is missing because ModifiedProperties (old and new) and ModifiedObjectResolvedName properties are NOT included in the log entries.

In order to solve this issue, the LogLevel parameter should be changed from None to Verbose to provide ModifiedProperties (old and new) and ModifiedObjectResolvedName properties. To enable the parameter please run the following cmdlet with Exchange Management Shell:

Set-AdminAuditLogConfig -LogLevel Verbose

The output should be like this:
[PS] C:Windowssystem32>Set-AdminAuditLogConfig -LogLevel Verbose
WARNING: The admin audit log configuration change you specified could take up to 60 minutes to take effect.

After that please run the Get-AdminAuditLogConfig cmdlet and check that LogLevel is set to verbose now:

LogLevel                     : Verbose

Go Up