Hello,
Thank you so much for posting here.
In my case, there will be event log 4732 as shown below if adding the user 999 to the group 99.
It is the Administrator account that is doing the adding to the group. So the Account Name is administrator.
So sorry that we could not clearly understand our meaning of "it is 'nt authority\system', the computername$ account". If possible, would you please kindly provide us the screenshot of the event log 4732?
For more information about this event ID, we could refer to:
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
Thank you so much. For any question, please feel free to contact us.
Best regards,
Hannah Xiong