App Control: Is it normal to see System as the user that modified a file on a network drive?
book
Article ID: 287331
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Is it normal behavior to see a file modified by 'System' if a file share is accessed over the network location file path and that file modified on the network drive?
Environment
App Control (formerly CB Protection): All supported versions
Network file shares
Resolution
Yes, files can be tracked on a network drive however there is no logged in user or agent on the network drive to track what user modified the file
Additional Information
In order for an agent to track modifications to files the file has to be modified on a disk that has an agent and a logged in user