Computer name changes trigger “object path” changes where the WHO CHANGED is reporting “System”

Active Directory
6.5 and older
Copy Article URL Copied

When  a computer account is changed, the Active Directory Change Summary contains 2 changes: one indicates the computer name changes and the second indicates the Object Path changes (regarding the same computer account):

Modified computer 18/10/2013 11:58:49 system unknown localdomainxServersWorkstation149 Object Path changed from “localdomainxServersWorkstation149” to “localdomainxServersWorkstation150
Modified computer 18/10/2013 11:42:28 DomainxAdministrator DC1.domainx.local localdomainxServersWorkstation149 Computer Name changed from “Workstation149.domainx.local” to “ Workstation150.domainx.local “

When a computer name is changed, the System (Active Directory) automatically changes the computer account attribute named Canonical-Name (for more information regarding this attribute refer to the following KB article

Changes to this attribute are being considered by Netwrix Auditor as the object path changes (since canonical-name  attribute reflects the full path to the object in Active Directory) and besides the computer name changes the product also adds an additional change (with “Object path” change details) with “system” in WHO column.

This is normal behavior and the reason this additional change is being reported as made by “system” is because the “Object path” change was a result of the Canonical-Name attribute change (performed by System (Active Directory)) and object path was not actually changed (the computer account is still in the OU).

This behavior is applicable only to computer account name changes.  If you move a computer account to another OU, the WHO column will contain the corresponding user account name.


Originally KB1787

Go Up