When a computer account is changed, the Active Directory Change Summary contains 2 changes: one indicates the computer name changes and the second indicates the Object Path changes (regarding the same computer account):
|Modified||computer||18/10/2013 11:58:49||system||unknown||localdomainxServersWorkstation149||Object Path changed from “localdomainxServersWorkstation149” to “localdomainxServersWorkstation150“|
|Modified||computer||18/10/2013 11:42:28||DomainxAdministrator||DC1.domainx.local||localdomainxServersWorkstation149||Computer Name changed from “Workstation149.domainx.local” to “ Workstation150.domainx.local “|
When a computer name is changed, the System (Active Directory) automatically changes the computer account attribute named Canonical-Name (for more information regarding this attribute refer to the following KB article http://msdn.microsoft.com/en-us/library/windows/desktop/ms675436(v=vs.85).aspx)
Changes to this attribute are being considered by Netwrix Auditor as the object path changes (since canonical-name attribute reflects the full path to the object in Active Directory) and besides the computer name changes the product also adds an additional change (with “Object path” change details) with “system” in WHO column.
This is normal behavior and the reason this additional change is being reported as made by “system” is because the “Object path” change was a result of the Canonical-Name attribute change (performed by System (Active Directory)) and object path was not actually changed (the computer account is still in the OU).
This behavior is applicable only to computer account name changes. If you move a computer account to another OU, the WHO column will contain the corresponding user account name.