Netwrix Auditor Displays Errors Following Recent Windows Update

Products Auditor Announcements
,
1

Auditor Microsoft KB Advisory
Auditor Microsoft KB Advisory1333×800 132 KB

Do you want to be notified of future product updates?

Are you subscribed to this category? If not, or if you're not sure, expand me to see how!

How to subscribe

Following the recent Windows update released by Microsoft, some Netwrix Auditor applications may display error messages. The affected modules include:

  • Netwrix Auditor for Windows Server
  • Netwrix Auditor for Windows File Servers
  • Netwrix Auditor for Active Directory

These errors\warnings do not affect the integrity of the audit log (unless the policy settings are disabled in audited servers). Our R&D team is actively investigating the issue and working on a fix. A patch will be released shortly, and we will notify you here on the Community as soon as it becomes available.

Thank you for your patience and understanding.

8 Likes
2

It appears that Microsoft might be fixing this on their end as well:

2 Likes
3

Hey what was the windows update that caused these issues?

4

@larevalo, this one:

5

Would this update only affect server that Netwrix is hosted on or would we need to run the Out-of-band patch to all devices?

6

It affects the target machines.

7

Is there a Netwrix patch for this as well or is it just the out of band windows update?

8

There’s no patch yet, but the team is working on it, we’ll release it soon.

1 Like
9

Could you share what errors are displayed in Windows when affected by the WU problem?

10

@stan82 it says

Unable to detect audit policy settings for the server ########## due to the following error: Netwrix Auditor cannot automatically configure advanced audit on servers running Windows NT 10.0.

2 Likes
11

Netwrix Account Manager here - My customer confirmed that installing the out-of-band Microsoft hotfix fixed the Netwrix Auditor issue for us.

3 Likes
12

Is there a Netwrix patch/update coming out for this? The only monitoring plan that we are experiencing issues with is our Windows Monitoring plan that watches over our domain controllers for Add/Remove programs, Services, Audit policies, etc… Applying an update to Netwrix would be a lot better than having to install an OOB patch to a bunch of domain controllers. If not, does someone have a link to the 2019 version of the KB so I can pass it on to our SysAdmins?

13

Hi @rob.ling , the patch is already available: Patch Version 10.7.13820 Released

1 Like
14

I installed 10.7.13820 and it did NOT fix the issue - I’m still seeing the log entries for nearly all of our monitored endpoints. I rebooted the Auditor and SQL servers for good measure but the issue still remains - any advice on what I can try next?

15

Hi Dan,

The patch that was released did fix the issue caused with Logon Activity plans that had errors about an Unknown Format with the registery. However, you are correct that the Auditor patch did not resolve the Windows NT 10.0 errors. Those errors will be resolved in a 2nd patch that we plan on releasing soon.

3 Likes
16

Understood - thanks for the clarification. :slight_smile:

17

Thanks all for saving me typing back to Dan. It is correct - the patch corrected two of the 3 issues I saw after the installation of the April Patch Tuesday patches. The AD Logon Activity and ADFS activity plans were both fixed.

As mentioned in my previous message, the Windows Server monitoring plans are still showing the Windows NT 10.0 errors. I will let support know to save us all some time.

Thanks!

2 Likes
18

Rob,

If you do not have a ticket yet with us, please let me know if you want one because we are tracking all customers who have the Windows NT 10.0 issue and we will be proactively reaching out to them once we have the new patch released that fixes this error. In addition, we will be posting in here as well.

1 Like
19

Michael,

Thank you. Support opened up a ticket for me on this as I mentioned it when I was testing another issue that had been addressed in a 10.7.13813.

1 Like