3

In our Org there was a change in a Profile made and a "Modified By" field points to one of our employees. We're sure that it's impossible for this person to log into SF that day so we wanted to investigate whether someone used a "Log In As" feature:

enter image description here

After downloading the Setup Audit Trail CSV file we noticed that there was indeed a change made. However, in a User column there are question marks only and we can't determine who exactly made these changes.

Note: "Delegated User" column is empty.

enter image description here

We also checked the login history that day but it looks like no one logged into the system at that time at all:

enter image description here

Is there any way to uncover these question marks? How is it actually possible to make such a hidden change?

Improve this question
5
  • Do you have event logs enabled in your org?
    – RedDevil
    May 16, 2019 at 16:43
  • 1
    Logging in/out as another user should absolutely show as both its own events in the Setup Audit Trail and any admin changes done while logged in as the user should show in the Delegate User column. I would contact Salesforce Support about the missing username in the Audit Trail download.
    – Thomas Taylor
    May 16, 2019 at 16:51
  • @RedDevil what do you mean saying Event Logs? This - help.salesforce.com/… ?
    – Przemysław Długoszewski-Tamoń
    May 16, 2019 at 19:59
  • @ThomasTaylor Thanks, will do that
    – Przemysław Długoszewski-Tamoń
    May 16, 2019 at 19:59
  • @notmyf4ulty - yes thats what i meant, you need to do a bit of investigative work and you can get the information you want using various event types
    – RedDevil
    May 17, 2019 at 5:54

1 Answer 1

Reset to default
1

I had the same problem. The solution that worked for me was to change my user's language to the one I'm seeing question marks for (in my case, Hebrew). After that I downloaded the file, opened it in Notepad and re-saved it with Save As and selecting the type file to All Files and the encoding to UTF-8.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .