In the operation log obtained when no one logs on, the user name will be recorded as “SYSTEM”, while the domain name will be recorded as “This computer name”.
When the user name in the logs is recorded as [SYSTEM], the domain name will surely be recorded as “This computer name”.
If the logon user performs operations within seconds after logon, the user name of log will be recorded as [SYSTEM].
In startup, shutdown, sleep, and return logs of PC, the user name will be recorded as [SYSTEM] and the domain name will be recorded as “This computer name”.
If multiple log-on users exist in Windows Vista®, Windows Server® 2008, or Windows® 7, the user names will surely be recorded as [SYSTEM] and the domain names will be recorded as “This computer name” in E-mail sending log and E-mail attachment prohibition log.
Under Windows Vista®, Windows Server® 2008, or Windows® 7, the user name of file operation log will be recorded as [SYSTEM] and the domain name will be recorded as [NT AUTHORITY].
When the log information recording was stopped due to a compulsory shutdown of the power of the client (CT), the log information will not be recorded.
