This might sound silly but did you check the recording?
Sometimes they recorded the options wrong and even though it it is doing exactly what it is programmed to do, someone crossed the names in the recording so they think it is being directed incorrectly.
If not, you can use Sysmon (and SSA I...