"

Changes to the directory objects for Foreign Security Principals are being reported as made by system

Last review: Dec 12, 2013
https://kb.netwrix.com/264
Copy Article URL Copied

The ForeignSecurityPrincipals container in Active Directory represent security principals from trusted domains external to the forest, and allows foreign security principals to become members of groups within the domain. The ForeignSecurityPrincipals  objects are being created automatically by system (Active Directory), so having changes of the foreignSecurityPrincipal object reported as made by system is a normal behavior of the Netwrix Auditor.

Added foreignSecurityPrincipal 4/12/2013 09:41:21 system unknown localdomainxForeignSecurityPrincipalsS-1-5-20-684578120-14483156-1569713544-17821 none
Added foreignSecurityPrincipal 4/12/2013 09:41:21 system unknown localdomainxForeignSecurityPrincipalsS-1-5-20-684578120-14483156-1569713544-17821 none
Added foreignSecurityPrincipal 4/12/2013 09:41:21 system unknown localdomainxForeignSecurityPrincipalsS-1-5-20-684578120-14483156-1569713544-11394 none
Added foreignSecurityPrincipal 4/12/2013 09:41:21 system unknown localdomainxForeignSecurityPrincipalsS-1-5-20-684578120-14483156-1569713544-4736 none

For more information regarding the ForeignSecurityPrincipals container and the ForeignSecurityPrincipals objects please refer to the following Microsoft KB articles:

http://technet.microsoft.com/en-us/library/cc779144(v=WS.10).aspx
http://technet.microsoft.com/en-us/library/cc755427(v=WS.10).aspx

 

 

Originally KB1792
 

Go Up