App Control: Is it normal to see System as the user that modified a file on a network drive?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Is it normal behavior to see a file modified by 'System' if a file share is accessed over the network location file path and that file modified on the network drive?

Environment

• App Control (formerly CB Protection): All supported versions
• Network file shares

Resolution

Yes, files can be tracked on a network drive however there is no logged in user or agent on the network drive to track what user modified the file

Additional Information

In order for an agent to track modifications to files the file has to be modified on a disk that has an agent and a logged in user