Return
-
Title
GPO modifications in GPMC shows the acting user as the service account -
Description
When a GPO is modified outside the tool using Group Policy Management Console, it only shows the service account as the user who modified the GPO. It does not display the actual account that made the change to the GPO in native tools.
-
Resolution
When a user makes a change in GPOADmin, it will note the proper account in the show history. But if the change is made outside the tool, it only shows the service account. This is because our product does not read who changed the object in native tools.
You will need to consult the event viewer on the DC to find out who made the change to the GPO or another piece of software, such as Change Auditor.