"

Changes to the Operating System of an computer account are reported as made by System

Last review: Dec 12, 2013
https://kb.netwrix.com/248
Copy Article URL Copied

Changes to the Operating System, Operating System Version and Operating System Service Pack attributes can be reported as made by System, this is a normal behavior explained by the Active Directory architecture.  The System (Active Directory) relies on individual computer accounts and updates these attributes each time the computer is restarted.

The Operating System Version is being received during communication between the client operating system and Active Directory and then automatically stored in the Active Directory computer account. The changes happen when the client operating system transmits new data to Active Directory in response to local changes on the computer (Service Pack installation, Operating System upgrade).

If these attributes are changed manually, Netwrix Auditor will report the corresponding user account the changes were made under. But once the computer for which the account attributes were changed is restarted, the System (Active Directory) will modify these attributes back because of the mechanism described above, and these changes will be reported as made by System.

Go Up