Looking for a bug fix list for all versions of Auditor?
All bug fixes will automatically be added here!
10.9 Updates
Netwrix Auditor 10.9 Update 1 (10.9.16400)
August 27, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Memory leak in the audit archive service that could leave the datasource manager stuck uninitialized after high load, causing the Web API to stop returning new Activity Records (as seen with SIEM integrations). | 419119 | 463696 | 439978 |
| SQL Server State-in-Time collection failing when databases contain external (Entra ID) users or groups, which previously caused snapshot upload errors and incomplete reports after cross-domain migrations or in-place upgrades. | 440809 | 474524 | 443994 |
| Azure AD/Entra ID State-in-Time snapshot uploads failing due to duplicate directory role membership records returned by the Microsoft Graph API, which previously caused role-membership reports like Global Administrators to return no data. | 441316 | 477823 | 442693 |
| Report generation failing with an “Inconsistent Report Server URL” error when the SSRS Report Server URL was configured with an explicit port 443, which previously required removing the port number as a workaround. | 442161 | 479410 | 371525 |
| File Storage Auditor collection stopping entirely after a snapshot became corrupted on Unity/EMC storage targets, which previously required manually clearing the snapshot folder to resume data collection. | 441016 | 478630 | 441087 |
| Netwrix Auditor Logs Collection Service crashing repeatedly when a Nutanix Files monitoring plan is active, caused by a syslog TCP reactor invoking a callback on an already-destroyed collector object. | 447641 | 482867 | N/A |
| Mailbox audit collection fails with ArgumentNullException in SerializationDataPsMailboxParser (System.Guid..ctor) | 450457 | 483208 | 450861 |
| Netwrix Auditor for Azure Files reports user actions as Entra Object ID (GUID) instead of UPN in “Who” column. | 445513, 445518 | 475884, 482070 | 445664 |
| Exchange Online throws “Unable to collect mailbox permissions due to the following error: Object reference not set to an instance of an object.” | 444558 | 481540 | 444947 |
| Insufficient space for TempDB and execution plan regression after bulk operations due to stale statistics on Conf* tables. | 444008 | 477732 | 450299 |
| Fixed SSRS report generation continuing to run on the server after a user navigated away or re-generated a report, which previously wasted server resources on abandoned report jobs. | N/A | N/A | 114059 |
| Fixed User Activity Monitoring incorrectly treating two different computers as the same monitored target when IP addresses were reassigned within a configured IP range, which previously caused monitoring data to merge under one identity. | N/A | N/A | 344712 |
| Fixed SharePoint Online State-in-Time statistics collection failing after Microsoft retired the legacy MSOnline API, which previously caused an access-denied error during snapshot collection. | N/A | N/A | 391452 |
| Fixed SharePoint Online permission reports failing to mark externally shared Entra ID accounts as External, which previously caused those users to appear in reports even when external sharing was disabled for the tenant or site. | N/A | N/A | 406505 |
Netwrix Auditor 10.9 Released: State-in-Time reporting and risk assessment for Azure Files
June 30, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Fixed incorrect hostname resolution in User Activity Video Recording caused by extra entries in the local hosts file — the Workstation field in Activity Records now shows the actual computer name instead of vmware-plugin. | 347095 | 415506 | 357515 |
| Fixed missing Workstation field data in Activity Records collected from Isilon data sources — the FSA collector now correctly populates it from Isilon audit logs. | 397371 | 452201 | N/A |
| Fixed a configuration validation bug where the FSA Isilon collector ignored the configured access zone name, triggering false “unconfigured audit settings” errors on non-default zones. | 420411 | 471947 | 422507 |
| Fixed SQL deadlocks that occurred when running SSRS-based reports (e.g. Failed Activity) due to a lock conflict between long-running report queries and the ManagementService background update routine. | 420838 | 472333 | 424595 |
| Fixed a silent failure on Windows Server 2012 R2 where clicking Export in predefined SSRS reports did nothing — caused by incorrect browser environment detection that prevented the save dialog from opening. | 433194 | 476035 | 433426 |
| Fixed an issue where agents were still deployed to target computers even when the User Activity Video Recording data source was disabled in a Monitoring Plan. | N/A | N/A | 370772 |
| Fixed a broken footer link in SSRS reports — clicking the Netwrix link no longer shows an “Inconsistent Reports Server URL” error. | N/A | N/A | 384483 |
| Fixed alert filters with detail-level conditions not firing for Group Policy, owner, and non-owner mailbox activities in Exchange Online, which caused missed alert notifications. | N/A | N/A | 389446 |
| Fixed a suboptimal join order in audit database views that caused unnecessary performance overhead when running reports covering Group Policy or Exchange mailbox activities. | N/A | N/A | 402917 |
| Fixed an unhandled exception crash in the Exchange Online mailbox owner audit collector when required application permissions are missing — it now logs a clear error and continues gracefully. | N/A | N/A | 425689 |
| Fixed incorrect report type classification — State-in-Time reports for Entra ID, Exchange Online, and SharePoint Online are now correctly displayed as State-in-Time reports in the Netwrix Auditor console. | N/A | N/A | 425861 |
10.8 Updates
Netwrix Auditor 10.8 Update 10 (10.8.15833)
June 2, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Fixed SharePoint Online activity reporting so the actual user is now correctly displayed in the “Who” field instead of “OneDrive SyncEngine”. | 435572 | 477160 | N/A |
| Resolved an issue where SharePoint Online State-in-Time data collection fails for site collections that have become inaccessible due to unlicensed accounts. | 435007 | 476851 | N/A |
| Corrected Exchange Online mailbox permission snapshot so “Deny” permissions are no longer recorded as “Allow” in State-in-Time reports. | N/A | N/A | 435671 |
Netwrix Auditor 10.8 Update 9 (10.8.15830)
May 13, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Improved reliability of Exchange Online auditing by resolving a type conversion issue that could interrupt data collection. | 433510 | 476267 | N/A |
| Optimized memory handling for Netwrix Auditor services to reduce excessive RAM consumption by lsass.exe. | 416208 | 469524 | N/A |
| Enhanced reporting accuracy for Entra ID group membership changes to correctly display added and removed users. | 425779 | 474387 | N/A |
| Resolved an issue that could cause the SQL Server Audit Service monitoring plan to remain indefinitely in a “Working” state. | 423438 | 473349 | N/A |
| Fixed manager notification delivery so email alerts are now sent correctly by Inactive User Tracker. | N/A | N/A | 415440 |
| Improved readability of Entra ID membership change events by displaying user UPNs instead of GUID values when changes are made through Microsoft Graph API. | N/A | N/A | 411171 |
| Corrected handling of report server URLs specified as IP addresses to ensure they are properly stored in Internet Settings. | N/A | N/A | 409728 |
| Improved report server URL management so FQDN values are now preserved correctly in Internet Settings, even when the same server was previously saved using a different format. | N/A | N/A | 409572 |
Netwrix Auditor Update 8 (10.8. 15813)
April 2, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Employee attributes are blank in Active Directory State-in-Time reports after an upgrade. | 419942 | 471763 | N/A |
| Support MSOLEDB providers instead SQL Server 2012 Native Client fot encrypted connections. | 411698 | 466554 | N/A |
| Meraki Dashboard auditing does not capture all content filtering (web traffic) logs. | 398690 | 453607 | N/A |
| Password Expiration Notifier sends emails to the managers that are not specified in the user’s properties. | 421173, 420376 | 472414, 471910 | N/A |
| Agent for User Activity Video Reporter does not write logs. | N/A | N/A | 420402 |
Netwrix Auditor Update 7 (10.8.15804): Streamlined permissions requirement for Exchange online auditing and bug fixes
March 5, 2026
| Description | Escalation # | Case # |
|---|---|---|
| Azure Files Auditing returns false positive Activity Reports | 409923 | 463107 |
| User Activity Video Recording displays no new data after upgrading to 10.8.15792.0 | 419084, 419122 | 471022, 471072 |
Netwrix Auditor 10.8 Update 6 (10.8.15792): Rebranded UI and minor improvements
February 5, 2026
| Description | Bug # |
|---|---|
| Added the ability to edit defined objects to exclude for the Active Directory Activities collector in the Netwrix Auditor user interface | 390456 |
Netwrix Auditor 10.8 Update 5 (10.8.15173) Released
January 29, 2026
| Description | Case # | Escalation # | Bug # |
|---|---|---|---|
| WorkingHours filter does not function as expected | 462953 | 409741 | N/A |
| Cannot collect Entra ID snapshot due to the following error: The remote server returned an error: (403) Forbidden. Request Authorization failed | 467404 | 412736 | N/A |
| Exchange Activity Records with details “Features Approved changed to…” are overwhelming Search | 463881 | 410518 | N/A |
| SharePoint Online SharedLinks are not being collected for some type of Site Collections | N/A | N/A | 406123, 409657 |
Netwrix Auditor 10.8 Update 4 (10.8.15119) Released
December 11, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Excluding events in Health Log by Event ID does not work when a Monitoring Plan is included | 459240 | 405535 |
| MS Teams auditing only getting partial audit data | 460981 | 407697 |
Netwrix Auditor Version 10.8 Update 3 (10.8.15089) Released
November 6, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Exchange Online search issue whilst filtering by Details | 455715 | 401317 |
| File Storage Auditing service crash in Access Reviews processing with recursion in group membership | 458490, 458999 | 404426, 405325 |
| Access denied in Active Directory collections using custom credentials for shared Long Term Archive folder | 456511 | 402025 |
| Azure Files shows a lot of collected data who=system in Search | 457503 | 403310 |
| Active Directory Auditing reports attribute changes made and reverted when they were not reverted | 439678 | 379632 |
| “Does not contain” filter for Details has been improved | N/A | N/A |
Netwrix Auditor Version 10.8 Update 2 (10.8.15066) Released
September 25, 2025
| Description | Case # | Escalation # |
|----|----|----|
| File Server - NetApp error message: “This operation is supported only when you are connected to the server.” | 442774 | 383885 |
| Exchange Online State in Time Collection issues in GCC tenants with China tenants | 442668 | 383794 |
| User Activity out of Memory issue | 446373 | 388612 |
| Bugfixing in Active Directory Restore Wizard | N/A | 383195, 383204, 378233 |
Netwrix Auditor Version 10.8. Update 1 (10.8.15036) Released
August 5, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Unable to complete search due to a collation conflict. | 450541 | 395448 |
| Netwrix Auditor for SharePoint Online State-in-Time reports incorrectly calculate permissions for external users. | 449385 | 393421 |
Netwrix Auditor Version 10.8 Released
July 1, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Fault tolerance improvement in integration with Netwrix Data Classification | 419364 | 357595 |
| Add detection and removal of corruption in the HealthData buffer of the Windows Server Auditing working folder | 413201 | 347000 |
| Improved error reporting in the CallHome feature | 443802 | 385073 |
| Remnants of failed uninstallation information in Agents.xml prevent targets from being re-added to the auditing scope of User Activity Auditing | 388568 | 344839 |
| Access error occurs when using NPS integration in environments with multiple domain controllers | 420343 | 358009, 358018, 358071 |
| Duplicate items appear in the Monitored Computers tab of the User Activity Auditing data source | 388568 | 127320 |
| Windows process security context is used for browsing SSRS reports instead of the explicitly provided credentials in Netwrix Console | 401299 | 339251 |
| ConfigServer nodes are being accessed by the Data Collecting Account of Inactive User Tracker | 400654 | 340091 |
| AD Restore Wizard improvement: Prevent deletion of indirectly checked objects when restoring a constructed attribute | 437805 | 379951 |
| Synology, Nutanix, Qumulo, Unity: No change detected when permissions are modified on top-level share objects | N/A | 306133 |
10.7 Updates
Patch Version 10.7.13850 Released
June 26, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Netwrix Auditor for VMware: Failed to process certain objects during State in Time collection. | 429223 | 367490 |
| Netwrix Auditor for Azure AD: Fixed high memory consumption issue. | 440700, 442895 | 380595 |
| Netwrix Auditor for Access Reviews: Unexpected memory consumption during file server data processing. | 441364 | 381831 |
| Netwrix Auditor for Inactive Users: Access Denied error when attempting to save a plan. | 443519 | 384657 |
| Alerts do not adjust to Daylight Saving Time (DST) changes. | 381815 |
Patch Version 10.7.13822 Released
April 23, 2025
The following table contains a comprehensive list of updates and fixes released on April 24, 2025.
| Description | Case # | Escalation # |
|---|---|---|
| Netwrix Auditor for Windows Server Unable to detect audit policy settings for the server | Ticket 440941 | 380872 |
| Netwrix Auditor for Access Review webpage closed with error - block access | Ticket 438749 | N/A |
Patch Version 10.7.13820 Released
April 17, 2025
The following table contains a comprehensive list of updates and fixes released on April 17, 2025.
| Description | Case # | Escalation # |
|---|---|---|
| Netwrix Auditor for Logon Activity: The audit policy data registry value has an unknown format | N/A | 382078 |
| Netwrix Auditor for File Servers: The audit policy data registry value has an unknown format | N/A | 382022 |
| Netwrix Auditor for Windows Server: Unable to detect audit policy settings for the server | Ticket 440941 | 380872 |
| Audit Configuration Assistant: The audit policy data registry value has an unknown format | N/A | 382151 |
| Netwrix Auditor for Sharepoint Online: Unable to parse the FileDeleted event | Ticket 440454 | 380338 |
| Netwrix Auditor for VMware: failed to collect data for state-in-time snapshot | Ticket 429223 | 367490 |
Patch Version 10.7.13813 Released
April 3, 2025
| Description | Case # | Escalation / Bug # |
|---|---|---|
| Netwrix Auditor for File Servers returns licensing error even though Access Reviews is not configured | Ticket 438897 | Issue 378875 |
| Netwrix Auditor for Exchange Online does not include some mailboxes in reports | Ticket 435479 | Issue 374939 |
| Performance and stability improvements in the Migration Tool for Working Folder | Ticket 428843 | Issue 367013 |
| Netwrix Auditor for Exchange Online reports unnecessary changes under NT SERVICE accounts | N/A | Bug 379153 |
Patch Version 10.7.13808 Released
March 4, 2025
- Feature 289061: [Access Reviews] Allow choosing subfolders for review
- Feature 362902: [Security] 2.3.7 Weak Assembly Control fix
- Issue 376203 Ticket 436229 Misspelling in omitproplist.txt file
- Issue 376182, 376332, 376726 Ticket 436211, 436372, 436761 NwUserActivitySvc failed to start when upgrading to 10.7
- Issue 374354 Ticket 434846: [CoreServices] Netwrix Auditor Archive Service Windows crashes on failed AR upload
Minor Version 10.7 Released
June 25, 2024
See the Netwrix Auditor 10.7 Bug Fix List (184.0 KB) PDF for a list of bugs fixed in this version.
The following versions may have limited or no support. Please see the