authority nt \ system

Now there are two accounts that appear that we do not know why. How to proceed with this situation? Has anyone had this problem? Can I delete these two accounts?

Hello ,

both accounts are predefined (builtin) accounts (NetworkService being the third) - Windows processes and most services run under one of these accounts.
What do you mean by can I delete - delete the from the endpoint?

Christian

No, I ask about delete from SOPHOS console. This situation is normal? Already happen with you or somebody?

Hello Tiago Toledo,

I'm afraid, I'm not using Central. The Central Admin Help doesn't mention these accounts or with which user detections in a system context (i.e. where one of these accounts accesses a file) are associated. Maybe some Central expert (jak?) can clarify. I'm not familiar with the GUI, though I assume that in the screenshots the column to the right of the detection lists the device and it seems the Central Admin automatically consolidates the builtin accounts.

Christian 

Central maps devices to the users via the login. I.e.

User <--> Login <--> Computer

You can delete a User and the Login and Device will remain in the system.  So you can create a new User, attach the exiting Login to it and the Computer will be linked.

Hopefully that makes sense.

So when you deploy to an endpoint, you can create a User (with email) up front and email them an installer link from Central.  When protected and messages in, it will automatically link the User to the Computer.
If you just use the generic installer from the Downloads page, when the computer messages in, it will create a new user from the login so in effect you have:

User (same as the login) <--> Login <--> Computer
You can rename the User to be more friendly than the login if needed.

There is also the scenario where you deploy to a computer when no one is logged in.  E.g. as startup script. At that point, the User can't be created from the login as there isn't one, so I thought it created the User name from the Computer Name.

I can only think that the User you see was created when no one was logged on to the endpoint.  Maybe there was a process where the System user was logged on interactively and the MCS software on the client picked up Loacal System as the account to create?  Seems odd.

In any case the User can always be changed/deleted/created

Regards,
Jak

Central maps devices to the users via the login. I.e.

User <--> Login <--> Computer

You can delete a User and the Login and Device will remain in the system.  So you can create a new User, attach the exiting Login to it and the Computer will be linked.

Hopefully that makes sense.

So when you deploy to an endpoint, you can create a User (with email) up front and email them an installer link from Central.  When protected and messages in, it will automatically link the User to the Computer.
If you just use the generic installer from the Downloads page, when the computer messages in, it will create a new user from the login so in effect you have:

User (same as the login) <--> Login <--> Computer
You can rename the User to be more friendly than the login if needed.

There is also the scenario where you deploy to a computer when no one is logged in.  E.g. as startup script. At that point, the User can't be created from the login as there isn't one, so I thought it created the User name from the Computer Name.

I can only think that the User you see was created when no one was logged on to the endpoint.  Maybe there was a process where the System user was logged on interactively and the MCS software on the client picked up Loacal System as the account to create?  Seems odd.

In any case the User can always be changed/deleted/created

Regards,
Jak