Subject Fields in Windows Server 2016 Showing... Expand / Collapse
Author
Message
Posted 3/3/2021 2:58:25 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/26/2020 10:45:34 AM
Posts: 2, Visits: 0
I am observing 4739 events that display the user account name in the subject fields and not the local computer name. The description of this event (se quote below) says that the subject fields will always show the local computer.

So is what I am seeing due to a recent change by Microsoft in how this event is logged? Or is there perhaps a different process other than a GPO update that can create this event? Has anyone else observed this?

I have observed this from two different networks (I am an MSSP) so this is not just a "one off " occurrence.

Unfortunately the Subject fields don't identify who actually changed the policy because this policy isn't directly configured by administrators. Instead it is edited in a group policy object which then gets applied to the computer. Therefore this event always shows the local computer as the one who changed the policy since the computer is the security principal under which gpupdate runs.
Post #8667
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:04pm