Another one might be when a network user changes a file on a share. Let's say this is running on the file server - presumably we get the local process name, and

Another one might be when a network user changes a file on a share. Let's say this is running on the file server - presumably we get the local process name, and presumably it would be running as Network Service or similar, so we wouldn't get the user that actually made the change?