System updated priority 5+ months after closure

[PLakin1]

I'm attempting to find what if any information from our instance on why System updated the priority of at least two tickets within about 2 hours of each other on the same day, over 5 months after the ticket was closed. System made the update and I cannot think of a single system we've altered or created that should have caused it to happen.

The tickets I've found with this issue, so far, are Incidents. There are no obvious similarities between the tickets; none of them were from a catalog item, they are to different assignment groups, for different impacts. Only a handful of tickets out of hundreds appear to have been affected. There were two sets of audit updates in the history that happened simultaneously.

Any help is appreciated.

Thanks,

Paul

[PLakin1]

Well, that's not what I wanted to hear, but it sounds like I need to focus on cleanup now.

I can restore values using a report on sys_audit to identify old and new values, but I'm having trouble thinking of the best way to prevent System from updating a field on a closed record. Any advice? If it was users I wouldn't have an issue, but I'm not sure what options prevent System from updating.

[PLakin1]

Well, I have to do more testing, but I put a BR in place to check active and priority change and abort the action. Hoping that does the trick so that I can prevent it from happening again, regardless of the source.