Banks, credit unions, insurance companies,
Changes to the directory objects for Foreign Security Principals are being reported as made by system
|The ForeignSecurityPrincipals container in Active Directory represent security principals from trusted domains external to the forest, and allows foreign security principals to become members of groups within the domain. The ForeignSecurityPrincipals objects are being created automatically by system (Active Directory), so having changes of the foreignSecurityPrincipal object reported as made by system is a normal behavior of the Netwrix Auditor.
For more information regarding the ForeignSecurityPrincipals container and the ForeignSecurityPrincipals objects please refer to the following Microsoft KB articles: