I ran report for PCI (Compliance Report on Object Access) after reviewed, I founded a discrepancy between the report and the original event log.
Report showed computername$ as username for any object access with event log 560 from computer services like system, network, etc. instead of the original user.
Evidence attached
Please help.
Jose
Usernames replaced with computername$ on Compliance Report on Object Access
Event log Analyzer Ver 6.1
Problem : Compliance Report on Object Access replaced username with computername$ for any object accessed from services accounts like(System, Network,etc)
Problem : Compliance Report on Object Access replaced username with computername$ for any object accessed from services accounts like(System, Network,etc)
Topic Participants
Jose Perez
eventlog_support
ronaldeddy
New to M365 Manager Plus?
New to M365 Manager Plus?
New to RecoveryManager Plus?
New to RecoveryManager Plus?
New to Exchange Reporter Plus?
New to Exchange Reporter Plus?
New to SharePoint Manager Plus?
New to SharePoint Manager Plus?
New to ADManager Plus?