I noticed something very strange when auditing changes to workflows.
An action was changed by the user account "firstname.lastname@example.org". I was wondering if anyone here knew why vRA would be rewriting a vRO Action (at least I assume that is what is happening). The action happens to be com.vmware.vra.ad.getObjectByDN. Below is a capture from the Events tab of the action.
Any insight much appreciated.
is this an Embedded vRO?
Yes. vRA 7.4 HF11.
Do you remember any change happening in vRA appliance on date and time captured in the screenshot you posted? like applied any hotfix or made any such change...
I don't see any documented evidence, but just suspecting that, this could be a case where one of the hotfix was released with updated action Elements for vRO which got imported by cafe-xxxxx user in vRO when you applied that hotfix.