In our Org there was a change in a Profile made and a "Modified By" field points to one of our employees. We're sure that it's impossible for this person to log into SF that day so we wanted to investigate whether someone used a "Log In As" feature:
After downloading the Setup Audit Trail CSV file we noticed that there was indeed a change made. However, in a User column there are question marks only and we can't determine who exactly made these changes.
Note: "Delegated User" column is empty.
We also checked the login history that day but it looks like no one logged into the system at that time at all:
Is there any way to uncover these question marks? How is it actually possible to make such a hidden change?