Send Knowledge Base Article
The article has been sent to your inbox successfully.
We never share your data
Changes to the Operating System of an computer account are reported as made by System
KB1848 | Last review: Dec 27, 2013 | Netwrix Auditor for Active Directory | 5.0 and above
|Changes to the Operating System, Operating System Version and Operating System Service Pack attributes can be reported as made by System, this is a normal behavior and being explained by the Active Directory architecture. The System (Active Directory) relies on individual computer accounts and updates these attributes each time the computer is restarted.
The Operating System Version is being received during communication between the client operating system and Active Directory and then automatically stored in the Active Directory computer account. The changes happen when the client operating system transmits new data to Active Directory in response to local changes on the computer (Service Pack installation, Operating System upgrade).
If these attributes are changed manually, Netwrix Auditor will report the corresponding user account the changes were made under. But once the computer (for which the account attributes were changed) is restarted, the System (Active Directory) will modify these attributes back because of the mechanism described above (and these changes will be reported as made by System).
Was this information helpful?