System account creating subgroups?

[cy_al]

Hi again,

I was planning on cleaning up the Lost&Found subgroup in our ePO due to subgroups created incorrectly when I got curious as to who may have created them. As I checked the audit logs, the username "system" was the one who created them. This username is disabled and cannot be edited even with admin account.

Is there any reason or cause why "system" is able to create subgroups even when disabled and even move systems to such subgroups? This can't be related to AD, as we don't sync AD with ePO at all and the client's AD doesn't have any containers that could be related to the created subgroups.

[cdinet · Accepted solution]

When an agent checks into epo, the system first goes into lost and found.  Whatever domain or workgroup that system is in, there will be a group created for that domain/workgroup name.  If you have sorting enabled, then the systems will move to their respective groups.  The system account will always be available to do background tasks and operations, but it is disabled for any login.