The following changes are reported as the “SHAREPOINT\system” value in the “Who” column:
- Changes made by an account which belongs to Farm Admins;
- Changes made by an account which is a Managed account for the Web Application Pool;
- Changes made by an account which is specified in the User Policy of the modified Web Application with the “Account operates as System” option enabled;
- Changes resulting from SharePoint Workflows.