nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

File Audit showing user as NT AUTHORITY\SYSTEM

jack_gillard_goodridge

I have set up a FileAudit filter but all logs are showing the user as NT AUTHORITY\SYSTEM. I installed the hotfix suggested in this post: Re: file audit nt authority but it hasn't worked?

Find more posts tagged with

Accepted answers

curtisi

Please update to 6.1 and let the LEM upgrade the Agents. Some operations will always show SYSTEM but you should see user names for most delete, create and write events once you upgrade.

All comments

rufat87

What version of LEM are you using? Is NT Authority\System the only user that appears in FIM logs?

jack_gillard_goodridge

LEM version is 6.0 I think. NT Authority\System is the only user showing under the File Audit filters (including the one that is pre-setup)

curtisi

Please update to 6.1 and let the LEM upgrade the Agents. Some operations will always show SYSTEM but you should see user names for most delete, create and write events once you upgrade.