Send Knowledge Base Article
The article has been sent to your inbox successfully.
We never share your data
Duplicate Active Directory changes in reports with system/unknown
KB1752 | Last review: Jul 22, 2014 | Netwrix Auditor for Active Directory | 6.0
|Sometimes in the Active Directory summary report you may see duplicate changes with "system" in the Who Changed and "unknown" in the Where Changed.
Usually this happens because of the DirSync Control design.
During data collections the product gets changes from the DyrSync control trough the same domain controller each time. But if this domain controller is unavailable, the products switches to another domain controller, and in this case the search results from the new domain controller may include changes reported by the old domain controller. In some cases, the new domain controller may return all objects and attributes, as with a full synchronization, and it can cause duplicate changes to appear.
Was this information helpful?