I found that the file server report shows "system" in all Who results. It should display domain\users. May I know anybody knows how to solve this problem? Many thanks.
Jump to content
Posted 23 July 2019 - 03:03 AM
Posted 23 July 2019 - 09:35 AM
"system" means the corresponding event is not found and modification is identified based on the snapshot, it might be caused by the following reasons:
1. operating system does not generate complete number of events representing a certain modification/activity at the file server;
2. SACL settings are not applied over the object (e.g. folder or file);
3. missing some auditing policies.