Under what circumstances would QSYS show up as having changed a user profile?

I'm trying to nail down the specific instances/circumstances under which
QSYS is would show up in audit journal as having changed a user profile -
entry type CP for "Create, change, or restore operation of user profile."

I know that QSYS is the "culprit" when a user disables their profile due to
too many invalid attempts.  I was also thinking that the QSECIDL1 job from
the SECTOOLS menu would do this under QSYS, but it runs under the profile
that submitted/scheduled the job.

Are there other instances when QSYS changes a user profile?

Best regards,

Steve Martinson
netiQ - "Work Smarter" 
Technical Support
Ph. +1 503 223-3023
Email:  Support-Houston@xxxxxxxxx <mailto:Support-Houston@xxxxxxxxx>
        VigilEnt-support@xxxxxxxxx <mailto:VigilEnt-support@xxxxxxxxx> (For
former PentaSafe VigilEnt products)

Manage your Service Requests on-line and utilize our Customer Forums. 
Current Support Plan customers, request access today at
<http://www.netiq.com/support/contacts.asp> 
Learn more about NetIQ Support at  <http://www.netiq.com/support/plans.asp>


"Our lives begin to end the day we become silent about things that matter."
- Martin Luther King Jr.