netwrix auditor release notes

Netwrix AuditorRelease NotesVersion: 6.5.112/10/2014

Legal Notice

The information in this publication is furnished for information use only, and does not constitute acommitment from Netwrix Corporation of any features or functions, as this publication may describefeatures or functionality not applicable to the product release or version you are using. Netwrix makesno representations or warranties about the Software beyond what is provided in the License Agreement.Netwrix Corporation assumes no responsibility or liability for the accuracy of the information presented,which is subject to changewithout notice. If you believe there is an error in this publication, please reportit to us in writing.

Netwrix is a registered trademark of Netwrix Corporation. The Netwrix logo and all other Netwrixproduct or service names and slogans are registered trademarks or trademarks of Netwrix Corporation.Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarksare property of their respective owners.

Disclaimers

This document may contain information regarding the use and installation of non-Netwrix products.Please note that this information is provided as a courtesy to assist you. While Netwrix tries to ensurethat this information accurately reflects the information provided by the supplier, please refer to thematerials provided with any non-Netwrix product and contact the supplier for confirmation. NetwrixCorporation assumes no responsibility or liability for incorrect or incomplete information provided aboutnon-Netwrix products.

2014 Netwrix Corporation.

All rights reserved.

2/22

Table of Contents1. What's New 4

2. Known Issues 5

2.1. General 5

2.2. Netwrix Auditor for Active Directory 5

2.3. Netwrix Auditor for Exchange 7

2.4. Netwrix Auditor for File Servers 10

2.5. Netwrix Auditor for SharePoint 11

2.6. Netwrix Auditor for SQLServer 15

2.7. Netwrix Auditor forWindows Server 16

3. What Has Been Fixed 20

3.1. What Has Been Fixed in 6.5.1 20

3.2. What Has Been Fixed in 6.5 20

3/22

Netwrix Auditor ReleaseNotes

1.What'sNew

1. What's NewNetwrix Auditor 6.5.1 is a maintenance release and includes various fixes and updates. The new NetwrixAuditor 6.5 features are:

l Netwrix Auditor now allows to detect and prevent breaches of sensitive information on file serversand storage appliances:

l Seewho has access to what acrossmultiple file servers and shares

l Analyze and compare file system state and permissions for any point in time

l Enhanced screen activity recording of privileged users: capture, search and review all user activityeven when users havemultiplemonitors

l Over 30 enhancements to improve scalability, performance and usability of Active Directory and fileservers change auditing

4/22


2. Known Issues

2. Known IssuesThis section provides a list of all currently known issues that customers may experience with NetwrixAuditor 6.5.1. For each issue, there is a brief description and aworkaround for the problem.

2.1. General

ID Issue Description Workaround

12895128961534213168

When upgrading from Netwrix Auditor 5.0.x to NetwrixAuditor 6.5.1, the list of installed programs may containmultiple entries of theNetwrix Auditor components.

This does not affect theproduct operability.Uninstall the older versions.

2.2. Netwrix Auditor for Active Directory


10401 Changes made through the Exchange Management Consolein the Organization Configuration node (Federation Trust,Organization Relationships and Hybrid Configuration tabs)may be displayed in an internal Active Directory format thatcan be difficult to interpret.

Contact Netwrix TechnicalSupport for information onhow to resolve this issue.

10831 Since the ADConfiguration partition is common for alldomains in a forest, any change to this partition will bereported by the product for each of the audited domains.

The name of the user who made the change will only bedisplayed for the domain where the change was made.Product reports for other audited domains will show the"System" value in the "Who Changed"column.

Ignore entries with the"System" value in the "WhoChanged"column for otherdomains.

10956 If a user made a change and then this user's account wasrenamed, moved or deleted within a short period of time(less than 10 minutes), Active Directory audit reports willdisplay a canonical user name in the "Who Changed" column.As a result, reports filtered by this user's name may containincorrect audit data.

This is going to be fixed inthe future product versions.

5/22

http://www.netwrix.com/support.html


2. Known Issues


11090 If changes to group membership are made throughExchange Control Panel, the product will report on additionand deletion of all groupmembers in addition to thesechanges.


11433 If an AD object is created using the Exchange ManagementConsole, and then renamed through Active Directory Usersand Computers within a short period of time (less than 10minutes), the product will show duplicate entries for thischange. One will show the Exchange Server name in the"Who Changed" column, and the other - the name of theuser whomade the change.

Ignore the duplicate entrywith the Exchange Serveraccount in the "WhoChanged"field.

11537 If a user is added through Active Directory Users andComputers, and then a mailbox is created for this userthrough the Exchange Management Console within a shortperiod of time (less than 10 minutes), the product will showduplicate entries for themailbox creation event. One changewill show the Exchange Server name in the "Who Changed"column, and the other - the name of the user whomade thischange.

Ignore the duplicate entrywith the Exchange Serveraccount in the "WhoChanged"field.

13619 If a change ismade to the audited domain through ExchangeServer 2010 or 2013 installed in another domain, theoriginating workstation for such changes will be reported as"Unknown".


13854 If a user who belongs to the audited domain is also amember of any groups in a different domain from anotherforest, the product will not be able to collect the informationon the latter user group membership, and these groups willnot be available in report filters.


13855 If a user who belongs to the audited domain is also amember of theDomain Local Group of a different domain inthe same forest, the product will not be able to collect theinformation on the latter user group membership, and thisgroup will not be available in report filters.


14291 If changes to Active Directory objects are made throughExchange 2010 or 2013 Management Console or ExchangeControl Panel, the "Workstation" field in reports showing thecomputer from which a change was made may contain


6/22


2. Known Issues


several workstations.

11988 If you are auditing a non-trusted domain, and the version ofthe ADSIin the audited domain is higher than in the domainwhereNetwrix Auditor is installed, reports may return errorsor contain incomplete or incorrect data.

Install an Netwrix Auditorinstance in the auditeddomain, or migrate theproduct to a computer withthe same ADSIversion as inthe audited domain.

23277 If you try to configure audit through the Active DirectoryAudit Configuration wizard for a domain that has morethan 64 domain controllers, the following error will appear:"The number of WaitHandles must be less than or equal to64".

If you have theAdjust Audit settings automatically optionenabled in Netwrix Auditor, you will get this error in ChangeSummaries and sessions as well.


In case you havemore than64 domain controllers inyour domain, Netwrixrecommends you toconfigure audit settingsmanually. SeeNetwrixAuditor Installation andConfiguration Guide formore information.

2.3. Netwrix Auditor for Exchange


11527 In Microsoft Exchange Server 2010 SP2, after a mailbox isrestored using the Active Directory Object Restore wizardshipped with Netwrix Auditor, it will be inaccessible forseveral hours throughMicrosoft Outlook or Outlook WebApp.

Wait for several hoursbefore using thismailbox.

For details on this issue,refer to the followingMicrosoft KnowledgeBaseArticle:You cannotaccess amailbox for severalhours after you disconnectand then reconnect themailbox in an ExchangeServer 2010 SP2environment

11110 ForMicrosoft Exchange Server 2010, changes to text stringsthat have line breaks will contain the before and after values

Check the resulting valuethrough Active Directory

7/22

https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdfhttp://support.microsoft.com/kb/2682047/en-us


2. Known Issues


only for the text fragment before the line break. The fact ofthe change itself will be reported for thewhole text string.

Users and Computers orother tools.

10956 If a user made a change and then this user's account wasrenamed, moved or deleted within a short period of time(less than 10 minutes), Exchange Server audit reports willdisplay a canonical user name in the "Who Changed" column.As a result, reports filtered by this user's name may containincorrect audit data.


10897 The product does not report on changesmade on anExchange Server with the Edge Transport role.


10896 For Microsoft Exchange Server 2010, changes made to itsconfiguration using certain cmdlets may be displayed withthe Exchange Server name in the "Who Changed"columninstead of a user name.


10762 ForMicrosoft Exchange Server 2010 and 2013, the previousvalues for somemodified attributes will not be reported.


10590 For Microsoft Exchange Server 2010, changes to theinetOrgPerson object type will be reported in the ExchangeServer audit reports with the "user" value in the "ObjectType" column.


10431 If a previously disconnected mailbox is reconnected to auser, the Exchange Server audit reports will display themailbox GUID instead of a canonical user name in the"Object Name" column.

If, as a result of this operation, the email address of this useris modified, this change will be reported in the ActiveDirectory reports with the Exchange Server name in the"Who Changed"column.

If you need to get acanonical user name in anExchange Server Auditreport, look for the "User"attribute in the "Details" fieldof the reconnected mailboxchange entry.

If you need to get the "WhoChanged"value for the emailaddress change entry, openExchange Server report forthe same time period andlook for the entry reflectingthe mailbox reconnection

8/22

http://www.netwrix.com/support.htmlhttp://www.netwrix.com/support.htmlhttp://www.netwrix.com/support.htmlhttp://www.netwrix.com/support.html


2. Known Issues


event. The user whoreconnected the mailbox isthe same user who initiatedthe email address changeevent. You can match theemail notification entry withthe mailbox reconnectionentry by comparing theObject Path field in theActive Directory audit reportwith theUser attribute in the"Details" field of theExchange Server auditreport.

9744

10037

If non-ownermailbox access auditing is disabled and then re-enabled after some time, or an upgrade is performed, datawill start to be collected only after the first scheduled datacollection task is run (at 3:00 AMby default). As a result,events that occur after the feature is re-enabled or upgradedand before the first scheduled task will not be reported.

Launch the scheduled datacollection task manuallyimmediately after thefeature is re- enabled orupgraded. To do this,navigate to Start Administrative Tools Task Scheduler or Start Control Panel ScheduledTasks (depending on yourWindows version), locate thetask titled "Netwrix Non-owner Mailbox AccessReporter for Exchange" andlaunch it.

9688 Non-owner actions performed with attachments to emailmessages are not tracked. The fact of accessing amessagecontaining an attachment, as well as all other actionsperformed with thismessage, will be reflected in reports.


9889 Non-owner renaming of mail folders cannot be tracked. Thefact of accessing a mail folder, as well as all other actionsperformed with it, will be reflected in reports.


9/22


2. Known Issues

2.4. Netwrix Auditor for File Servers


2871

762

Windows native audit does not write folder creationoperations to the event log. As a result, Netwrix Auditor,which relies on native audit, will report these changes withthe "System"value in the "Who Changed" column, or notreported at all if the Large server support option isenabled.


6462 If a switch between the active and the passive node occurredon a clustered file server, the changes that took placebetween the last data collection and the switch will bereported with the "System" value in the "WhoChanged"column, or not reported at all if the Large serversupport option is enabled.

If you plan a switch,manually launch a datacollection task (click the Runbutton in the NetwrixAuditor console on yourManaged Object page), waituntil it has completed andthen perform the switch. Ifthe switch is unplanned,contact Netwrix TechnicalSupport.

6615 If you apply advanced audit configuration (available onWindows Vista or later) to the Object Access policy that mustbe configured to log audit data, the product will be unable toverify these audit settings. As a result, you will be gettingwarningmessages saying that audit has been configuredincorrectly.

Ignore these warningmessages as they do notaffect the productfunctionality. This is going tobe fixed in the next productversion. For moreinformation on theadvanced auditconfiguration, refer toNetwrix Auditor Installationand Configuration Guide.

8496 If theAttach the email reports as a CSVfile option isenabled, and an attachment is opened inMicrosoft Excel,non-ASCII symbolsmay not be rendered correctly.

Instead of double-clicking anattached report, save the file,then in Microsoft Excelnavigate to DataFromText and select the file youwant to view.

10/22

http://www.netwrix.com/support.htmlhttp://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf


2. Known Issues


9450

9208

8887

If the Large server support option is enabled, viewing anobject's security properties may be reported as a change tothese properties.


10000 The product cannot detect overwriting of the security eventlog on aNetAppFiler appliance.

Configure the scheduleddata collection task to runseveral times a day, orenable automatic logarchiving. For instructionsrefer to Netwrix AuditorAdministrator's Guide.

1734 The product cannot verify the current audit policy settingson an EMC VNX/VNXe/Celerra appliance. As a result, if theaudit policy is configured incorrectly, you will be seeingempty or incorrect reports with no warning.txt file attachedexplaining the reason for the problem.

For instructions on how toconfigure audit to monitoran EMC VNX/VNXe/Celerraappliance, refer to NetwrixAuditor Installation andConfiguration Guide.

18844 The "No session found" error appears when trying togenerate state-in-time reports for theManaged Objectcontaining special characters or numbers in its name.


No data loss occurs.

19247 If you select a \\Server\Share\Subfolder for auditing, ChangeSummaries and reports will include data on \\Server\Share ,and files and subfolders inside Subfolder, but will miss theinformation on Subfolder itself.


15923 After enabling the state-in-time reports functionality for EMCCelerra and NetApp appliances, Change Summaries andsessions contain the "Unable to resolve DNS" error.


2.5. Netwrix Auditor for SharePoint


1549 SharePoint Central Administration URL specified onManaged Object creation cannot exceed 80 characters.

If your SharePoint CentralAdministration URLexceeds80 characters, create a shortname and specify it in the

11/22

https://www.netwrix.com/download/documents/Netwrix_Auditor_Administrator_Guide.pdfhttps://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf


2. Known Issues


Alternate AccessMappings, and create a SiteBinding in IIS for SharePointCentral Administration v4.

9165 If youmove an Itembetween Lists using theMovemenuoption on the Site Settings - Site Content and Structurepage, audit reports and Change Summaries will contain twochange entries associated with this event: List ItemRemovedand List ItemAdded.

Ignore themultiple changeentries.

12683 When a lot of SharePoint changes are made within a shortperiod of time (15-20 changes per second), some eventsmaybe lost and not reflected in audit reports and ChangeSummaries because of the default IIS recycle settings (the IISWorker Process that accumulates data on changes isrestarted before all data is written to the audit database).

Modify the default IIS recyclesettings to keep data whenthe process is restarted.Fordetails on how to configurerecycling, refer to thefollowingMicrosoft article:Recycling Settings for anApplication Pool.

12883 The timestamp for SharePoint farm configuration changes inaudit reports and email Change Summaries is the timewhenNetwrix Auditor generates the daily Change Summary, notthe actual event time.


9133 When you activate the Publishing Feature, SharePoint auditreports may contain a number of internal changesassociated with this event.


13445 The following changes are reported by the product with the"Unknown" value in the "Who Changed" column:

l Automatic creation of SharePoint groups on sitecreation if it uses unique permissions instead ofinheriting them

l All changesmade under the "Anonymous" user if thesecurity policy permits such changes


13455 When a web application is created or when Service Accountsare modified, SharePoint audit reports and ChangeSummaries may contain a number of internal securitychanges for the following site collection:http://%centraladministration%/sites/help.


12/22

http://www.iis.net/configreference/system.applicationhost/applicationpools/add/recycling


2. Known Issues


13918 The following changes are reported with the"SHAREPOINT\system" value in the "Who Changed" column:

l Changesmade under an account that belongs to FarmAdmins

l Changesmade under an account that is aManagedaccount for theWeb Application Pool

l Changesmade under an account that is specified in theUser Policy of themodifiedWeb Application with the"Operates as a system" option enabled

l Changes resulting from SharePoint Workflows


13923 Creation, deletion and modification of folders in SharePointLibraries will be reported by the product with the "List Item"value in the "Object Type" column.

Creation, deletion and modification of subfolders anddocuments inside these sub-folders will be reported with thepath to the list instead of the folder path in the "Object Path"column.


13926 The following changes are reported by the product with the"Not applicable" value in the "Who Changed"column:

l Addition and removal of servers, changes to servicestatus

l Web application creation and deletion, changes to keyweb application settings

l Changes to the following web application securitypolicies: anonymous access policy, user policy, securitypolicy levels

l Site collection creation and deletion, changes to key sitecollection settings

l Addition, removal and deployment of SharePointsolutions

l Addition and removal, activation and deactivation offarm-wide features


13977 The following changes are reported with the "Not applicable"value in the "Workstation"field in the Change Summary


13/22


2. Known Issues


emails (in audit reports the "Workstation" field will bemissingfor these changes):

l Content Security changes

l Assignment of permissions to SharePoint sites,lists, libraries, folders, documents or items

l Permission inheritance break or restore on anySharePoint object

l Creation and deletion of SharePoint groups, aswell as changes to groupmembership

l Creation, deletion andmodification of permissionlevels

l Farm configuration changes

l Changes to the Farm administrators groupmembership

l Addition and removal of servers, changes toservice status

l Web application creation and deletion, changes tokey web application settings

l Changes to the following web application securitypolicies: anonymous access policy, user policy,security policy levels

l Site collection creation and deletion, changes tokey site collection settings

l Addition, removal and deployment of SharePointsolutions

l Addition and removal, activation and deactivationof farm-wide features

The "Workstation" field is not reported for content changes ifthey weremade in one of the following ways:

l Through powershell cmdlets

l Through the Site settings Content and Structuremenu

l Through Microsoft servers and Office applicationsintegrated with SharePoint

14/22


2. Known Issues


l Through SharePoint workflows

l Through theUpload Multiple Filesmenu option

l Through theOpen With Explorermenu option

l Through a shared folder

l Deletion of items through the context menu

14009 If an object was deleted within 30 minutes after itspermissions were modified, permission modifications will bereported by the product with the "SharePoint Object" valuein the "Object Type" column.


14591 When you create a SharePoint site based on a SharePoint2010 template, SharePoint audit reports may containchange entries for the creation of all default Lists and Itemsthat belong to this site.

This applies to the following SharePoint 2010 templates:

l Access Services Site

l AssetsWeb Database

l Charitable ContributionsWeb Database

l ProjectsWeb Database

l IssuesWeb Database

l Collaboration Portal


15051 If you create a site collection based on the SharePoint 2010template on SharePoint 2013, and then update the templateto SharePoint 2013, audit reports and Change Summarieswill contain a number of internal changes associated withthis event.


2.6. Netwrix Auditor for SQLServer


3133

7688

The following changes are reported with the "System" valuein the "Who Changed" column:


15/22


2. Known Issues


7769

7871

l Modifications to Server Instance, ApplicationRole,Database, Stored Procedure and Tables on aSQLServer 2000 instance

l Backup operations

l Removal of an SQLJob together with unused schedules

l Database restore frombackup to a new database

3117 If you are auditing a SQLServer 2000 instance installed onan x64-bit system, automatic audit configuration will fail(you will receive awarningmessage).

Manually specify the path toSQLtrace logs. Forinstructions on how to dothis, refer to the followingNetwrix Knowledge basearticle: How I can change theSQLServer Change Reporterlog path on the SQLServer?

6789 With the Database Content Audit option enabled, whenyou try to perform the UPDATE/INSERT/DELETE operationsin an audited database, an error is returned stating that thestatements cannot be executed because the database ownerSIDcannot be resolved or SIDs do not match.

NOTE: Database backup and restoremay lead to unresolvedor not matching SIDs.

For detailed informationabout the issue and for asolution, refer to thefollowing Netwrix Knowledgebase article: An error isreturned stating that youhave problems accessing anaudited database.

2.7. Netwrix Auditor for Windows Server


12743

12765

12795

13365

The following changes will be reported with the "System"value in the "Who Changed"column:

l Creation of new scheduled tasks on computers runningWindows 2003.

l Renaming a scheduled task on computers runningWindows XP/2003 if no other parameters aremodifiedfor the renamed task.

l Changes to child registry keys (i.e. the keys that otherkeys link to).


16/22

https://www.netwrix.com/kb_ij2R_9XHIhttp://www.netwrix.com/kb/1856


2. Known Issues


l Renaming a network connection on computers runningWindows XP/2003 (for Windows Vista/7/2008/2012,the "Who Changed" column will contain the targetcomputer name).

l Creation of a new registry key if no value has been setfor it.

12740 If you browse for an Active Directory container when addingitems to the audited Computer Collection, child domains oftrusted domains will not appear in this list.

User a different choiceoption (computer name / IPaddress range / import fromfile) to specify targetcomputers.

12745 Software upgrade is reported by the product as twoconsecutive changes: software removal and softwareinstallation. The entry for software removal will have the"System" value in the "Who Changed" column.

Look for the user name inthe entry for softwareinstallation to determinewho performed the upgrade.

12936 No audit data is collected from computers runningWindowsXP/2003 if they are specified in the audited ComputerCollection as CNAME records.

Specify the actual name ofthe target computer.

11637 Although you can configure the product to write video only ifcertain applications are activated, the whole desktop will becaptured, not just the application windows that trigger avideo recording session.

In the future productversions a choice option isgoing to be implemented toselect whether the wholedesktop must be captured,or only the selectedapplications and windows.

12100 OnWindows XP/2003, the information on the launch ofapplications through the "Run as different user"menuoption is not written to the detailed activity log (reportsmetadata). As a result, it will be unavailable for data searchand positioning inside video files.


12182 If a monitored user connects via an RDPsession to acomputer that is not audited by Netwrix Auditor (i.e. theagent is not installed on the remote computer), theinformation on the launch of applications and openingwindows inside this RDPsession is not written to the detailedactivity log (reports metadata). As a result, data search and

To get a detailed activity log,configure the product tomonitor the computeraccesed through anRDPconnection. When acomputer is added to the

17/22


2. Known Issues


positioning inside video files will be unavailable for suchvideo recording sessions. All activity inside such RDPsessionwill still be captured and will be availbale for playback.

audited computer collection,the Netwrix Auditor agentwill be installed on it that willcollect both video and adetailed activity log(metadata).

12451 Video capture of an RDPsession will be terminated if thissession is taken over by another user.


12776

11838

On computers running Windows XP/2003/Vista/2008, if aconsole application (i.e. an application that does not have itsown graphical user interface and is executed via a commandline interface) is launched, the information about this launchand the command line parameters are not written to thedetailed activity log (reports metadata). Therefore, datasearch and positioning inside video files will be unavailablefor such applications. The command line parameters and thelaunch of the application will still be captured and will beavailable for playback.


12763 Links to video recordings will not open from reports saved inthe doc/xls format, or reports received by subscription andattached to emails in one of these formats.

Save reports in the PDFformat and select thisformat when configuring asubscription to a report.

12770 If integration of video records into audit reports for differentaudited systems is enabled, the Active Directory, GroupPolicy and Exchange Server audit reports called "All Changeswith Video" contain audit data for Active Directory andExchange Server and Group Policy changes.

Contact Netwrix TechnicalSupport to get separatereports for each type ofaudit data.

12807 On Windows 8/Windows Server 2012, the information onthe launch of Windows Store (Metro-style) applications is notwritten to the detailed activity log (reports metadata), asapplications in a tile-based interface do not have applicationdescriptions or window titles. Therefore, data search orpositioning inside video files will be unavailable for suchapplications. A video recording session will no start beforethe user accesses their desktop for the first time.


12951 If an Activity Records summary is generated with the Showdetailed user activity log option enabled, and then saved

For positioning and datasearch, watch Activity

18/22

http://www.netwrix.com/support.html


2. Known Issues


in the HTMLformat, clicking the links for differenttimestampswill start video playback from the beginning.

Records summaries from theNetwrix Auditor console.

10029 After a ManagedObject that consolidated event logs isdeleted from the Netwrix Auditor console, a scheduled taskassociated with thisManaged Object will not be deletedautomatically.

Delete the task manually inthe Task Scheduler. The taskname is"NetwrixManagement console -Event Log Manager - your_Managed_object_name".

10305 If you launch data collection manually for event log auditing(by clicking Run on yourManaged Object page in theNetwrixAuditor console), and there is an invalid email address in theEvents Summary Recipients list, email delivery will fail to alladdresses, not just the invalid one.

When you add a newaddress to the EventsSummary Recipients list, itis recommended to clickVerify to check if thisaddress is valid.

19/22


3.What HasBeen Fixed

3. What Has Been Fixed

3.1. What Has Been Fixed in 6.5.1This section lists all issues that have been fixed in Netwrix Auditor 6.5.1.

Issue Description

22287 Netwrix Auditor does not write events on non-ownermailbox access to theNetwrix Non-owner Mailbox Access AgentWindows event log.

21943 Netwrix Auditor fails to collect audit data on VMware changes when running onWindowsServer 2012/Windows Server 2012 R2.

22988 After restarting, Netwrix Auditor restores a default value (*) in the Filter by accountname field on the Inactive User Tracking page instead of retrieving a value selectedpreviously.

23266 After upgrade, Netwrix Auditor restores default values in the modified filters of pre-defined real-time alerts.

24154 Netwrix Auditor cannot collect events if a Computer Collection Managed Object scope isspecified as an Active Directory container.

3.2. What Has Been Fixed in 6.5This section lists all issues that have been fixed in Netwrix Auditor 6.5.

Issue Description

9512 Audit of EMC VNX/VNXe/Celerra appliances cannot be configured in the Netwrix Auditorconsole, and is only available through the Standard configurationmode.

9514 Audit of NetApp Filer appliances cannot be configured in theNetwrix Auditor console, andis only available through the Standard configurationmode.

13633 Netwrix Auditor may hang up while processing logon events from the audited ActiveDirectory domain. Recommended for audit of large AD domains with the OriginatingWorkstation option turned on.

14648 It takes Netwrix Auditor a long time to import logon events collected from the auditedActive Directory domain to the audit database, or perform the retention procedure for

20/22



Issue Description

such events. Recommended for audit of large AD domains with the OriginatingWorkstation option turned on.

15564 A new registry key has been added (overwrite_datasource) that disables datasourceoverwrites for Enterprise-Wide reports on the Report Server. Fixes the problem of thedouble- hop authentication described in https://www.netwrix.com/kb/1628 forEnterprise-Wide reports and dashboards.

13677 It takes Netwrix Auditor a long time to generate the 'User AccountsWith Last Logon Time'report. Recommended for auditing large AD domains.

13678 It takes Netwrix Auditor a long time to generate the 'Groups Without Members' report.Recommended for auditing AD domains with large number of groups.

113351563015744

Netwrix Auditormay hang up while processing changes from the audited Active Directorydomain. Recommended for auditing AD domains with large amount of changes(>50K/day).

15794 Netwrix Auditor stops working when trying to process a large amount of changes from theaudited Active Directory domain. Recommended for auditing AD domains with a largeamount of changes (>150K/day).

15833 Netwrix Auditor does not report on changes to objects, which were renamed or removedduring the data collection. Recommended for auditing AD domains with a large amount ofchanges (>5K/hour).

15532 Removed the incorrect note "To collect data from the entire SQL Server (all instances), clickBack and select Windows Server" as object type" from the Specify Items step of the NewManaged Object wizard.

16910 Netwrix Auditor reports "old" changes occurred long time ago if the source ExchangeServer, where the changes are being collected, has changed (e.g. due to connectionproblems).

16609 Netwrix Auditor does not show "Who", "When" and "Where" values for changes onmembershipmade to accounts belonging to another forest (ForeignSecurityPrincipals).

16563 Netwrix Auditor does not collect events from the Security event log backups of theaudited domain controllers that were created during the event log data collection.Recommended for auditing AD domains with a large number of the Security event logbackups on domain controllers.

17630 Netwrix Auditor does not track inactive users on domain controllers with modified

21/22

https://www.netwrix.com/kb/1628



Issue Description

primary DNS suffix.

17400 Netwrix Auditor fails to generate a Change Summary; TheOutOfMemory exception occurswhen auditing large databases.

18192 Netwrix Auditor incorrectly alerts on password expiration for users with Smart Cardauthentication.

18400 Netwrix Auditor does not report on changes to Exchange Servers if the enterprise licenseis applied only for "Netwrix Auditor for Active Directory" solution (in that case ExchangeServers are audited in a freewaremode).

18402 Netwrix Auditor does not restoremembership for deleted user accounts via RollbackWizard.

18207 Event log consolidation was improved.

22/22

1. What's New2. Known Issues2.1. General2.2. Netwrix Auditor for Active Directory2.3. Netwrix Auditor for Exchange2.4. Netwrix Auditor for File Servers2.5. Netwrix Auditor for SharePoint2.6. Netwrix Auditor for SQL Server2.7. Netwrix Auditor for Windows Server

3. What Has Been Fixed3.1. What Has Been Fixed in 6.5.13.2. What Has Been Fixed in 6.5

netwrix auditor release notes

Documents

netwrix auditor releasenotes1

netwrix logo

aboutnonnetwrix products

information use

incomplete information

whats newnetwrix auditor

legal noticethe information

known issues