You received Group Policy Change Report showing some changes you do not believe you made. The changes of Group Policy settings look as if they were renamed from human readable text to a computer specific SID.
By default the product uses a domain controller for the data collection which is most available. Some of the domain controllers may not resolve the Security Identifiers (SID) correctly. The product may connect to the domain controller that does not resolve SIDs, hence it gathers the SIDs of the settings instead of their names. The SID of the group policy setting will be considered as a change when comparing to the previous snapshot.
To prevent this from happening we recommend using the same domain controller for collecting Group Policy changes.
In order to determine the domain controller that should be used, please submit a ticket to Netwrix Technical Support and provide the following information:
1. The problematic Group Policy Change report (it should contain the date and time the report was received).
2. The Group Policy Change Reporter tracing logs (the entire content of the tracing folder) – the default location is C:Program Files (x86)NetWrixAD Change Reporter Full VersionGPOExecTracing
3. The tracing of the Active Directory Change Report module – the entire content of the Tracing subfolder located in the installation folder of the product.