Changes to the Operating System of an computer account are reported as made by System

Email It to Me Print this Page
Changes to the Operating System, Operating System Version and Operating System Service Pack attributes can be reported as made by System, this is a normal behavior and being explained by the Active Directory architecture.  The System (Active Directory) relies on individual computer accounts and updates these attributes each time the computer is restarted.

The Operating System Version is being received during communication between the client operating system and Active Directory and then automatically stored in the Active Directory computer account. The changes happen when the client operating system transmits new data to Active Directory in response to local changes on the computer (Service Pack installation, Operating System upgrade).  
Change TypeObject TypeWhen ChangedWho ChangedWhere ChangedObject NameDetails
Modifiedcomputer14/11/2013 11:21:36systemunknown\local\domainx\Computers\WST3412Computer Operating System set to "Windows 7 Enterprise N"
Computer Operating System Version set to "6.1 (7601)"
If these attributes are changed manually, Netwrix Auditor will report the corresponding user account the changes were made under. But once the computer (for which the account attributes were changed) is restarted, the System (Active Directory) will modify these attributes back because of the mechanism described above (and these changes will be reported as made by System).
Was this information helpful?