Duplicate Active Directory changes in reports with system/unknown

Active Directory
Reporting
6.5 and older
7.0-8.5
9.0-9.7
9.8
https://kb.netwrix.com/142
Copy Article URL Copied

Sometimes Active Directory summary report may show you duplicate changes with “system” in the Who Changed and “unknown” in the Where Changed.

Usually this happens because of the DirSync Control design.

During data collections the product gets changes from the DirSync control through the same domain controller each time.

But if this domain controller is unavailable, the products switches to another domain controller, and in this case the search results from the new domain controller may include changes reported by the old domain controller.

In some cases, the new domain controller may return all objects and attributes, as with a full synchronization, and it can cause duplicate changes to appear.

Go Up