Windows 10: Event ID 5136 - NT Authority/SYSTEM modified the default domain policy

HelloI have auditing of GPO changes turned on. While we have password complexity enabled, while being audited it was found to be disabled.After searching the logs from the GPO modified date, we found that it was the SYSTEM that made the changes. Leaving 2 entries. one for value deleted and one for value added.This happened one year ago and i thought maybe a team member changed it but they all denied this. So i turned on the auditing and one year later i see the same but now with some evidence.{"timestamp":"2023-04-19T08:48:24.000Z","hostname":"XXXXX-DC02.xxxxx.int","event_code":"5136","descrip

:)

 

Event ID 5136 for group policy changes by NT AUTHORITY\SYSTEM

Hi,

I would like to understand, why and in what circumstances NT AUTHORITY\SYSTEM do the group policy changes in AD. This question popups after I filter out the event log: 5136.

Thanks.

 

no event 5136 recorded in DC - Windows Server 2012 R2

I'm using Windows Server 2012 R2 as DC. And I have enable audit policy: Directory Service Changes - Success.

Besides, I also checked dsa.msc -> domain, and set the audit as following selection for Everyone,

This object and all descendand objects:

Write all properties
Modify permissions

But when I modified some attributes of a user, there was no event 5136 recored in Event Viewer. That's why???

 

Event ID 10016: All Win 10 machines in the domain are affected!

All Windows 10 computers in our domain are suddenly and unexpectedly affected by this error that will logged about every hour in the Event log:

It looks like there's a solution to this problem that may work [here],
however this is quite complicated and requires multiple steps on each machine!



Now some thoughts:

• How could this happen?
  
• Why doesn't MS provides a fix?
• How can we easily fix this on all machines in a domain, possibly through an automated task?