There is a FEATURE that the OS is obtained from the AD properties of the host. If you have machines that change OS but not name SEC can get confused about what OS they are. Seems like sophos is using the "operatingSystem" attribute in AD to populate…