Hi we are facing exactly the same issue. The question is what initiated C:\Windows\TEMP\vmware-SYSTEM\VMwareToolsUpgrader.exe to be executed under system account.
If we are executing VMwareToolsUpgrader.exe manually we are getting real username in log instead of NT AUTHORITY\SYSTEM.
Please could someone help us to find out the root cause of this ?
Any help is more than appreciated.