While attempting to run a report for local administrator password access from Local Security Solution 6.1 (LSS), the report, for some of the client machines, rather than referencing a computer/username, displayed "User RID 500" instead. Who is he? :)
Further research showed that Local Security Solution (LSS) uses a "Local User Inventory Policy" which, by default, has a capture interval of every 12 hours. This inventory sends a nse file to the Notification Server (NS) that contains all the needed data to properly create a local user resource. This should get created as "Computer Name/User". LSS also has the password reset policy that sends an event up containing the password change information. Because the password change is on a known RID (Relative Identifier),( in this case, the local Administrator account, which has a pre-defined RID of 500), the current policy applies to new comptuers.
The issue of transposing the...