Issue Installing MCP Server via MSI on Netwrix Auditor

Products Access Analyzer Discussions & Questions
,
1

Hello,
We attempted to install the MCP Server for Netwrix Auditor using the MSI method. The installation completed successfully, and all required dependencies were installed, including .NET Framework, Netwrix Auditor version 17, Claude Desktop, and appropriate credentials with sufficient privileges.
We tried with multiple accounts and also ran the software under the SYSTEM context, but the issue persists, which suggests it is not related to permissions.
As soon as we access Claude, it displays errors, as shown in the attached screenshots and logs.
We are very interested in getting this to work, as the integration between the MCP Server and Netwrix Access Analyzer was successful.

We would appreciate your support on this matter.

The image displays a user interface indicating an error with the Netwrix Auditor Local service, highlighting issues such as server disconnection and JSON format problems, along with options to open logs and settings. (Legendado por IA)
The image displays a user interface indicating an error with the Netwrix Auditor Local service, highlighting issues such as server disconnection and JSON format problems, along with options to open logs and settings. (Legendado por IA)1388Ă—667 355 KB

main.log (6,0,KB)
mcp.log (18,1,KB)
mcp-server-netwrix-auditor-local.log (61,0,KB)
window.log (27,0,KB)

2 Likes
2

Hello Gustavo,

Thank you very much for the detailed explanation and the logs — that’s extremely helpful.

Claude captures the entire output from the MCP server process when trying to start it. Typically, everything is configured to avoid unexpected output — especially when using the MSI installation method, which should set things up correctly.

However, based on the error messages like:

 "CLR: Assert", "File: D:\a...", "C:\Program"...

…it looks like the MCP server is printing unexpected output directly to stdout or stderr. This output is not valid JSON, which causes Claude to disconnect from the MCP server immediately upon launch.

To help us troubleshoot further, could you please share the netwrix-auditor-local section from your claude_desktop_config.json file?

You can usually find this config file at:
C:\Users\{your_username}\AppData\Roaming\Claude\claude_desktop_config.json
Or, as shown in your screenshot, just click “Edit Config” in the Claude app.

:backhand_index_pointing_right: Please make sure to remove any usernames and passwords from the config before sending it to us.

We’ll be happy to assist further once we have this information!

1 Like
3

Hello Eugene!

Here is the config file:
claude_desktop_config.json (398,Bytes)

2 Likes
4

Thanks again for the details you’ve provided so far — it’s been very helpful.

We’d like to share a quick update and a possible explanation.

The MCP Server you’re launching is a self-contained .NET 9 executable.
Starting with .NET 9, Microsoft has enabled CET Shadow Stacks (hardware-based stack protection) by default. On some systems (especially Windows 10 or Server 2022 without the latest updates), this can cause the .NET runtime to crash with an internal CLR: Assert.

We suspect this may be exactly what’s happening in your case. The issue has been reported by other .NET 9 users as well

To help confirm this, could you please provide us with:

  • Your exact Windows version and build number
    (you can check it via “winver” dialog — press ⊞ Win + R and type winver)

  • The exit code returned by the MCP server when run from the command line:
    (Open cmd.exe, go to the MCP Server folder and run)

    NetwrixAuditorMCPServer.exe --check
echo ExitCode %ERRORLEVEL%

  • If available, the MCP Server logs from:
    C:\ProgramData\Netwrix Auditor MCP Server\Logs

This will help us confirm the root cause and recommend the right fix.

Thanks again for your cooperation — we really appreciate it!
Let us know if you run into any issues with the steps above.

1 Like
5

Hello Eugene,

OS Name: Windows Server 2022
Version: 21H2
Build: 20348.169
Exit Code: -1073740286

The folder “Netwrix Auditor MCP Server” (or anything similar) does not exist under C:\ProgramData.

6

Hello Gustavo,
I suggest you to have a look to my thread: Use AI to Simplify Investigations with Netwrix Auditor - #6 by veronica_cips
In my lab I solved a similar issue only runninc MCP server from a path withouth any space.
Hope this helps!

1 Like
7

Hello Veronica,

Unfortunately, it didn’t work. I changed the installation path to C:\NetwrixAuditor\MCPServer, but I’m still getting the same error.

8

Hi Gustavo,

Thank you very much — your report helped us uncover an important compatibility scenario.

We’re preparing to release a new version of the MCP Server installer soon, which will improve reliability on systems affected by this issue.

In the meantime, since we’ve confirmed that Exit Code -1073740286 = 0xC0000602 (STATUS_FAIL_FAST_EXCEPTION), which matches a known .NET 9 CET crash on systems without full Shadow Stack support, here are two recommended workarounds:

  • Update Windows Server 2022 with the latest cumulative updates (e.g., KB5034129 or newer), so the OS fully supports hardware-enforced CET/Shadow Stacks.

  • Or temporarily disable CET for the MCP Server process:

    Set-ProcessMitigation -Name NetwrixAuditorMCPServer.exe -Disable UserShadowStack

Thanks again for highlighting this — your feedback is truly appreciated.
Let us know if you try either workaround or need any further assistance.

2 Likes
9

Hi Eugene,

Thank you so much for your detailed response and guidance.

I’m happy to confirm that after installing the latest cumulative updates for Windows Server 2022, the issue has been fully resolved. The MCP Server is now running correctly, and everything appears to be working as expected.

I truly appreciate the quick support and the thorough explanation provided. It’s great to know that my report contributed to identifying this compatibility scenario.

I really appreciate your assistance and the clear guidance provided throughout the process.

2 Likes