Looking for a bug fix list for all versions of Auditor?
All bug fixes will automatically be added here!
10.9 Updates
Netwrix Auditor 10.9 Released: State-in-Time reporting and risk assessment for Azure Files
June 30, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Fixed incorrect hostname resolution in User Activity Video Recording caused by extra entries in the local hosts file — the Workstation field in Activity Records now shows the actual computer name instead of vmware-plugin. | 347095 | 415506 | 357515 |
| Fixed missing Workstation field data in Activity Records collected from Isilon data sources — the FSA collector now correctly populates it from Isilon audit logs. | 397371 | 452201 | N/A |
| Fixed a configuration validation bug where the FSA Isilon collector ignored the configured access zone name, triggering false “unconfigured audit settings” errors on non-default zones. | 420411 | 471947 | 422507 |
| Fixed SQL deadlocks that occurred when running SSRS-based reports (e.g. Failed Activity) due to a lock conflict between long-running report queries and the ManagementService background update routine. | 420838 | 472333 | 424595 |
| Fixed a silent failure on Windows Server 2012 R2 where clicking Export in predefined SSRS reports did nothing — caused by incorrect browser environment detection that prevented the save dialog from opening. | 433194 | 476035 | 433426 |
| Fixed an issue where agents were still deployed to target computers even when the User Activity Video Recording data source was disabled in a Monitoring Plan. | N/A | N/A | 370772 |
| Fixed a broken footer link in SSRS reports — clicking the Netwrix link no longer shows an “Inconsistent Reports Server URL” error. | N/A | N/A | 384483 |
| Fixed alert filters with detail-level conditions not firing for Group Policy, owner, and non-owner mailbox activities in Exchange Online, which caused missed alert notifications. | N/A | N/A | 389446 |
| Fixed a suboptimal join order in audit database views that caused unnecessary performance overhead when running reports covering Group Policy or Exchange mailbox activities. | N/A | N/A | 402917 |
| Fixed an unhandled exception crash in the Exchange Online mailbox owner audit collector when required application permissions are missing — it now logs a clear error and continues gracefully. | N/A | N/A | 425689 |
| Fixed incorrect report type classification — State-in-Time reports for Entra ID, Exchange Online, and SharePoint Online are now correctly displayed as State-in-Time reports in the Netwrix Auditor console. | N/A | N/A | 425861 |
10.8 Updates
Netwrix Auditor 10.8 Update 10 (10.8.15833)
June 2, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Fixed SharePoint Online activity reporting so the actual user is now correctly displayed in the “Who” field instead of “OneDrive SyncEngine”. | 435572 | 477160 | N/A |
| Resolved an issue where SharePoint Online State-in-Time data collection fails for site collections that have become inaccessible due to unlicensed accounts. | 435007 | 476851 | N/A |
| Corrected Exchange Online mailbox permission snapshot so “Deny” permissions are no longer recorded as “Allow” in State-in-Time reports. | N/A | N/A | 435671 |
Netwrix Auditor 10.8 Update 9 (10.8.15830)
May 13, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Improved reliability of Exchange Online auditing by resolving a type conversion issue that could interrupt data collection. | 433510 | 476267 | N/A |
| Optimized memory handling for Netwrix Auditor services to reduce excessive RAM consumption by lsass.exe. | 416208 | 469524 | N/A |
| Enhanced reporting accuracy for Entra ID group membership changes to correctly display added and removed users. | 425779 | 474387 | N/A |
| Resolved an issue that could cause the SQL Server Audit Service monitoring plan to remain indefinitely in a “Working” state. | 423438 | 473349 | N/A |
| Fixed manager notification delivery so email alerts are now sent correctly by Inactive User Tracker. | N/A | N/A | 415440 |
| Improved readability of Entra ID membership change events by displaying user UPNs instead of GUID values when changes are made through Microsoft Graph API. | N/A | N/A | 411171 |
| Corrected handling of report server URLs specified as IP addresses to ensure they are properly stored in Internet Settings. | N/A | N/A | 409728 |
| Improved report server URL management so FQDN values are now preserved correctly in Internet Settings, even when the same server was previously saved using a different format. | N/A | N/A | 409572 |
Netwrix Auditor Update 8 (10.8. 15813)
April 2, 2026
| Description | Escalation # | Case # | Bug # |
|---|---|---|---|
| Employee attributes are blank in Active Directory State-in-Time reports after an upgrade. | 419942 | 471763 | N/A |
| Support MSOLEDB providers instead SQL Server 2012 Native Client fot encrypted connections. | 411698 | 466554 | N/A |
| Meraki Dashboard auditing does not capture all content filtering (web traffic) logs. | 398690 | 453607 | N/A |
| Password Expiration Notifier sends emails to the managers that are not specified in the user’s properties. | 421173, 420376 | 472414, 471910 | N/A |
| Agent for User Activity Video Reporter does not write logs. | N/A | N/A | 420402 |
Netwrix Auditor Update 7 (10.8.15804): Streamlined permissions requirement for Exchange online auditing and bug fixes
March 5, 2026
| Description | Escalation # | Case # |
|---|---|---|
| Azure Files Auditing returns false positive Activity Reports | 409923 | 463107 |
| User Activity Video Recording displays no new data after upgrading to 10.8.15792.0 | 419084, 419122 | 471022, 471072 |
Netwrix Auditor 10.8 Update 6 (10.8.15792): Rebranded UI and minor improvements
February 5, 2026
| Description | Bug # |
|---|---|
| Added the ability to edit defined objects to exclude for the Active Directory Activities collector in the Netwrix Auditor user interface | 390456 |
Netwrix Auditor 10.8 Update 5 (10.8.15173) Released
January 29, 2026
| Description | Case # | Escalation # | Bug # |
|---|---|---|---|
| WorkingHours filter does not function as expected | 462953 | 409741 | N/A |
| Cannot collect Entra ID snapshot due to the following error: The remote server returned an error: (403) Forbidden. Request Authorization failed | 467404 | 412736 | N/A |
| Exchange Activity Records with details “Features Approved changed to…” are overwhelming Search | 463881 | 410518 | N/A |
| SharePoint Online SharedLinks are not being collected for some type of Site Collections | N/A | N/A | 406123, 409657 |
Netwrix Auditor 10.8 Update 4 (10.8.15119) Released
December 11, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Excluding events in Health Log by Event ID does not work when a Monitoring Plan is included | 459240 | 405535 |
| MS Teams auditing only getting partial audit data | 460981 | 407697 |
Netwrix Auditor Version 10.8 Update 3 (10.8.15089) Released
November 6, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Exchange Online search issue whilst filtering by Details | 455715 | 401317 |
| File Storage Auditing service crash in Access Reviews processing with recursion in group membership | 458490, 458999 | 404426, 405325 |
| Access denied in Active Directory collections using custom credentials for shared Long Term Archive folder | 456511 | 402025 |
| Azure Files shows a lot of collected data who=system in Search | 457503 | 403310 |
| Active Directory Auditing reports attribute changes made and reverted when they were not reverted | 439678 | 379632 |
| “Does not contain” filter for Details has been improved | N/A | N/A |
Netwrix Auditor Version 10.8 Update 2 (10.8.15066) Released
September 25, 2025
| Description | Case # | Escalation # |
|----|----|----|
| File Server - NetApp error message: “This operation is supported only when you are connected to the server.” | 442774 | 383885 |
| Exchange Online State in Time Collection issues in GCC tenants with China tenants | 442668 | 383794 |
| User Activity out of Memory issue | 446373 | 388612 |
| Bugfixing in Active Directory Restore Wizard | N/A | 383195, 383204, 378233 |
Netwrix Auditor Version 10.8. Update 1 (10.8.15036) Released
August 5, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Unable to complete search due to a collation conflict. | 450541 | 395448 |
| Netwrix Auditor for SharePoint Online State-in-Time reports incorrectly calculate permissions for external users. | 449385 | 393421 |
Netwrix Auditor Version 10.8 Released
July 1, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Fault tolerance improvement in integration with Netwrix Data Classification | 419364 | 357595 |
| Add detection and removal of corruption in the HealthData buffer of the Windows Server Auditing working folder | 413201 | 347000 |
| Improved error reporting in the CallHome feature | 443802 | 385073 |
| Remnants of failed uninstallation information in Agents.xml prevent targets from being re-added to the auditing scope of User Activity Auditing | 388568 | 344839 |
| Access error occurs when using NPS integration in environments with multiple domain controllers | 420343 | 358009, 358018, 358071 |
| Duplicate items appear in the Monitored Computers tab of the User Activity Auditing data source | 388568 | 127320 |
| Windows process security context is used for browsing SSRS reports instead of the explicitly provided credentials in Netwrix Console | 401299 | 339251 |
| ConfigServer nodes are being accessed by the Data Collecting Account of Inactive User Tracker | 400654 | 340091 |
| AD Restore Wizard improvement: Prevent deletion of indirectly checked objects when restoring a constructed attribute | 437805 | 379951 |
| Synology, Nutanix, Qumulo, Unity: No change detected when permissions are modified on top-level share objects | N/A | 306133 |
10.7 Updates
Patch Version 10.7.13850 Released
June 26, 2025
| Description | Case # | Escalation # |
|---|---|---|
| Netwrix Auditor for VMware: Failed to process certain objects during State in Time collection. | 429223 | 367490 |
| Netwrix Auditor for Azure AD: Fixed high memory consumption issue. | 440700, 442895 | 380595 |
| Netwrix Auditor for Access Reviews: Unexpected memory consumption during file server data processing. | 441364 | 381831 |
| Netwrix Auditor for Inactive Users: Access Denied error when attempting to save a plan. | 443519 | 384657 |
| Alerts do not adjust to Daylight Saving Time (DST) changes. | 381815 |
Patch Version 10.7.13822 Released
April 23, 2025
The following table contains a comprehensive list of updates and fixes released on April 24, 2025.
| Description | Case # | Escalation # |
|---|---|---|
| Netwrix Auditor for Windows Server Unable to detect audit policy settings for the server | Ticket 440941 | 380872 |
| Netwrix Auditor for Access Review webpage closed with error - block access | Ticket 438749 | N/A |
Patch Version 10.7.13820 Released
April 17, 2025
The following table contains a comprehensive list of updates and fixes released on April 17, 2025.
| Description | Case # | Escalation # |
|---|---|---|
| Netwrix Auditor for Logon Activity: The audit policy data registry value has an unknown format | N/A | 382078 |
| Netwrix Auditor for File Servers: The audit policy data registry value has an unknown format | N/A | 382022 |
| Netwrix Auditor for Windows Server: Unable to detect audit policy settings for the server | Ticket 440941 | 380872 |
| Audit Configuration Assistant: The audit policy data registry value has an unknown format | N/A | 382151 |
| Netwrix Auditor for Sharepoint Online: Unable to parse the FileDeleted event | Ticket 440454 | 380338 |
| Netwrix Auditor for VMware: failed to collect data for state-in-time snapshot | Ticket 429223 | 367490 |
Patch Version 10.7.13813 Released
April 3, 2025
| Description | Case # | Escalation / Bug # |
|---|---|---|
| Netwrix Auditor for File Servers returns licensing error even though Access Reviews is not configured | Ticket 438897 | Issue 378875 |
| Netwrix Auditor for Exchange Online does not include some mailboxes in reports | Ticket 435479 | Issue 374939 |
| Performance and stability improvements in the Migration Tool for Working Folder | Ticket 428843 | Issue 367013 |
| Netwrix Auditor for Exchange Online reports unnecessary changes under NT SERVICE accounts | N/A | Bug 379153 |
Patch Version 10.7.13808 Released
March 4, 2025
- Feature 289061: [Access Reviews] Allow choosing subfolders for review
- Feature 362902: [Security] 2.3.7 Weak Assembly Control fix
- Issue 376203 Ticket 436229 Misspelling in omitproplist.txt file
- Issue 376182, 376332, 376726 Ticket 436211, 436372, 436761 NwUserActivitySvc failed to start when upgrading to 10.7
- Issue 374354 Ticket 434846: [CoreServices] Netwrix Auditor Archive Service Windows crashes on failed AR upload
Minor Version 10.7 Released
June 25, 2024
See the Netwrix Auditor 10.7 Bug Fix List (184.0 KB) PDF for a list of bugs fixed in this version.
The following versions may have limited or no support. Please see the