Hi everyone we have been running LEM on several 2008 r2 boxes and we have just started running it on a couple 2012 servers. About 5 or 6 times through the day we get the following notification of an event triggering.
'Group changed "Builtin\Administrators" security enabled local group at 2013-07-15 15:37:33.0 on xyserver.domain.com'
I have found these events in the windows logs but we aren't changing this manually and it's happening on both 2012 servers we are running.
Has anyone come across this and is there a solution or a way to deal with it. I assume it's something that is typical with 2012 as it's happening on both 2012 servers we have. I prefer not to simply block those alerts as I would like to know if that group is being changed.
Thanks for any help