ErrorSharePoint Online Audit Service

Products Auditor Discussions & Questions
,
1

I use Netwrix Auditor. I have a monitoring plan for SharePoint Online. For the past few days, I have been receiving several instances of this error:

  • Source: SharePoint Online Audit Service

  • Event ID: 3228

  • Computer: server. myaddomain. org

  • Description: Monitoring plan: MP - SharePoint

  • Item: mydomain. onmicrosoft. com

  • Message: State-in-time data collected partially: Failed to collect state-in-time snapshot data for site collection https://mydomain-my.sharepoint.com/personal/user_mydomain_onmicrosoft_com due to the following error: Error get response for GetSite: The access to the website has been blocked. To resolve the issue, contact the administrator.

The users triggering this error were all deleted or unlicensed several years ago.

Why does Netwrix continue to see OneDrive sites for users deleted years ago (or those whose licenses were removed), and more importantly, why is it throwing an error?

2

Same here. Seeing the same on multiple customer environments.

3

Have you found a solution?
For me, exactly since April 28.
And it affects SOME “deleted” users (not all) and 2 in “production”.
And the error occurs at night, during snapshot creation: “Failed to collect state-in-time snapshot data for site collection”

4

No!
I was hoping for a response from Netwrix, but I see there isn’t one.

5

Hi everyone,

Thank you for reporting this — we’re aware of the issue.

The errors you’re seeing (Event ID 3228, “The access to the website has been blocked”) are related to ongoing changes on the Microsoft side that affect how handles access to OneDrive site collections belonging to deleted. These sites are still enumerated by SharePoint APIs, but access to them is being blocked — hence the partial state-in-time data error.

We are working on a fix for this issue.

In the meantime, the recommended workaround is to exclude the affected site collections using the OmitSitScStoreList.txt file. Add the URLs of the problematic sites to the file and сollector will skip them.

We’ll update this thread once the fix is available. Apologies for the inconvenience.

6

Hi Stefano,

This is a known issue we are actively tracking. Earlier this year, Microsoft made a change that forces unlicensed OneDrive accounts into a “Fully Archived” status 93 days after the user’s license is removed. The OneDrive technically still exists, but it is no longer accessible.

On the Microsoft side, you can either assign a license to the affected account or completely delete the unlicensed account. On the Netwrix Auditor side, we have released an update to Netwrix Auditor which does help address this issue. You can download that version at https://releases.netwrix.com/products/auditor/10.8/auditor-10.8.15833.zip. Once you update to the latest version of Auditor, these error messages will be converted to warning messages which will ensure that the Monitoring Plan is no longer in a Take Action status. You can also add these sites to an omit list to prevent Netwrix Auditor from attempting to access them at all.

If you would like to omit these sites completely, it may be beneficial to first gather a list of all Fully Archived sites. There are two ways to do this.

Option 1 — SharePoint Admin Center:

  1. Sign in to the SharePoint Admin Center
  2. Go to Reports → OneDrive Accounts
  3. Click Active users with no license
  4. Click View more details
  5. Click Download Report

Option 2 — PowerShell:
Get-SPOSite -IncludePersonalSite $true -Limit All ` -Filter "Url -like '-my.sharepoint.com/personal/'" | Where-Object { $_.ArchiveStatus -eq "FullyArchived" } | Select-Object Url, Title, ArchiveStatus, LockState

Once you have the list of sites, you will need to locate your Working Folder in Netwrix Auditor. You can find it by running the following PowerShell command:
Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\WOW6432Node\Netwrix Auditor\DataPathOverride" -Name "(Default)"

If this command does not return a value, your Working Folder is at the default location: C:\ProgramData\Netwrix Auditor\

From there, open the following file:
%Working Folder%\Netwrix Auditor for SharePoint Online\Configuration\<GUID>\OmitSitScStoreList.txt

Add each of the Fully Archived site URLs to this text file and the error will stop appearing.

We would also love your feedback on how we plan to continue to address this in future releases. We are reviewing an option that would allow customers to skip inaccessible sites entirely. If this is something you would find valuable, we would greatly appreciate an upvote on our community idea post: Option to skip unaccessible SharePoint Online sites

Please let us know if you have any questions or run into any issues with these steps.