3

In our Org there was a change in a Profile made and a "Modified By" field points to one of our employees. We're sure that it's impossible for this person to log into SF that day so we wanted to investigate whether someone used a "Log In As" feature:

enter image description here

After downloading the Setup Audit Trail CSV file we noticed that there was indeed a change made. However, in a User column there are question marks only and we can't determine who exactly made these changes.

Note: "Delegated User" column is empty.

enter image description here

We also checked the login history that day but it looks like no one logged into the system at that time at all:

enter image description here

Is there any way to uncover these question marks? How is it actually possible to make such a hidden change?

5
  • Do you have event logs enabled in your org? – RedDevil May 16 '19 at 16:43
  • 1
    Logging in/out as another user should absolutely show as both its own events in the Setup Audit Trail and any admin changes done while logged in as the user should show in the Delegate User column. I would contact Salesforce Support about the missing username in the Audit Trail download. – Thomas Taylor May 16 '19 at 16:51
  • @RedDevil what do you mean saying Event Logs? This - help.salesforce.com/… ? – Przemysław Tamoń May 16 '19 at 19:59
  • @ThomasTaylor Thanks, will do that – Przemysław Tamoń May 16 '19 at 19:59
  • @notmyf4ulty - yes thats what i meant, you need to do a bit of investigative work and you can get the information you want using various event types – RedDevil May 17 '19 at 5:54
0

I had the same problem. The solution that worked for me was to change my user's language to the one I'm seeing question marks for (in my case, Hebrew). After that I downloaded the file, opened it in Notepad and re-saved it with Save As and selecting the type file to All Files and the encoding to UTF-8.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.