Banks, credit unions, insurance companies,
Computer name changes trigger "object path" changes where the WHO CHANGED is reporting “System”
|When a computer account is changed, the Active Directory Change Summary contains 2 changes: one indicates the computer name changes and the second indicates the Object Path changes (regarding the same computer account):
Changes to this attribute are being considered by Netwrix Auditor as the object path changes (since canonical-name attribute reflects the full path to the object in Active Directory) and besides the computer name changes the product also adds an additional change (with “Object path” change details) with "system" in WHO column.
This is normal behavior and the reason this additional change is being reported as made by "system" is because the “Object path” change was a result of the Canonical-Name attribute change (performed by System (Active Directory)) and object path was not actually changed (the computer account is still in the OU).
This behavior is applicable only to computer account name changes. If you move a computer account to another OU, the WHO column will contain the corresponding user account name.