This article contains references to the most popular Active Directory, Exchange and Group Policy changes which may be reported as made by “System” by Netwrix Auditor.
Who Changed Shows System for Real Time Alerts
Computer name changes trigger “object path” changes where the WHO CHANGED is reporting “System”
Changes to the Operating System of an computer account are reported as made by System
Duplicate changes in report with system/unknown
Changes to the directory objects for Foreign Security Principals are being reported as made by system
Why is the “Workstation” field reported as “unknown”?
Configuration and Schema changes are being duplicated for all monitored domain in forest and reported as made by System
Service principle name attribute changes are being reported as made by System or by computer account