Skip to main content

Known Limitations

These are behaviors of Access Analyzer 26.1 to plan around. Each item links to the page that covers it in full.

Installation​

The installer must run as root or through sudo; a non-root account cannot complete it.

Access Analyzer serves the web application only over HTTPS, and the installer never generates a certificate, so you must have one ready for the server's hostname, which must be a DNS name rather than an IP address. See Requirements.

Sources​

  1. File Server sources sign in with NTLMv2 only, not Kerberos, so the file server must accept NTLM authentication for the service account.
  2. Access Analyzer doesn't support the SMB 1x protocol.
  3. An Active Directory source covers one domain and doesn't follow trusts, so add one source per domain.
  4. You can't delete a source while a scan execution is running or pending on it, or once scans have run against it; stop the execution or wait for it to finish first.

Service Accounts​

  1. You can't change a service account's type after you save it, and you can't delete an account while it is connected to a source. Create a new account for a different type, and point sources elsewhere before deleting.
  2. Access Analyzer doesn't support passphrase-protected SSH private keys. Create a key without a passphrase.

Agents​

  1. You can't delete, rename, or label the System agent, and it shares the server with Access Analyzer itself, so deploy a dedicated agent for heavy scans.
  2. You can't remove an agent while a scan is running on it, and removal leaves the agent software on the host until you uninstall it.
  3. A scan routed by label never falls back to the System agent. If no online agent carries the label, the execution waits, and Access Analyzer marks it Failed after about two hours.
  4. After a release moves k3s forward, agents can't join a media install that you set up from an earlier release, because dspm-installer upgrade doesn't upgrade k3s. install-agent exits with code 16.
  5. While install-agent runs, its --token value is visible in the host's process list and in sudo logs. Run it only on a host where you trust everyone who can see them.

Scans​

  1. You can't change a scan's type after creation; to collect something else, create another scan.
  2. A Sensitive data scan needs a completed Access scan on the same source, because it works from that inventory. By default it classifies only the file types on the include list and skips files above 10 MB, both set in Application settings.
  3. After 90 days, Access Analyzer deletes executions that end as Completed, Failed, or Cancelled; Completed with errors and Stopped executions stay until you delete the scan. An execution's Detailed logs tab holds the last 1,000 entries. When a failure isn't explained there, look in System logs.

Sensitive Data Patterns​

  1. You can't edit or delete built-in patterns and groups, and there is no switch to turn off a single built-in pattern. To edit a pattern, create a custom pattern and copy the built-in pattern.
  2. An empty group selection doesn't turn classification off; the scan classifies against every group, built-in and custom.
  3. Sensitive data scans extract text from Excel, Word, Portable Document Format (PDF), and plain text files. They don't read text in images or open encrypted documents.

Dashboards and Reports​

  1. User admins don't see Dashboards, and report content doesn't load for them; give people who need reports the Viewer or Admin role.
  2. File system permission reports show account and group names only after an Active Directory Identity Sync has run for the domain, so pair a File Server scan with an Identity Sync. The Guides walk through both.

Users and Sign-in​

  1. There is no self-service password reset. An Admin or User admin resets a local account's password from Settings > Users.
  2. Local accounts lock after three consecutive wrong passwords and stay locked until an Admin or User admin clicks Unlock. A session ends after 4 hours of inactivity or 8 hours after signing in. An account's type (local or federated) can't change after creation.
  3. After you connect a single sign-on (SSO) provider, the web application has no control to disconnect it, replace it, connect a second one, or upload a new certificate authority (CA) certificate; keep a record of your configuration and contact Netwrix support for any of those.
  4. Access Analyzer never creates users on its own: a directory user can sign in only after an Admin or User admin adds them as a Federated (SSO) account with the email address the directory reports. Directory groups don't map to roles.

Backups and System Logs​

  1. A backup holds the configuration database, including settings and user accounts, but not scan results, the analytics store behind dashboards and reports, or the server's own configuration.
  2. Backups run daily at 02:00 Coordinated Universal Time (UTC), and you can't change the time. There is no control to restore, download, or run a backup on demand; a restore is a manual procedure on the server.
  3. Access Analyzer keeps System logs for 30 days, a period you can't change, and a download holds at most 10,000 entries. Split a longer range with From and To.

Netwrix Activity Monitor​

  1. An enrollment token is valid for one hour, and generating a new token invalidates the previous one. One token can enroll several agents, so finish enrolling within the hour to avoid having to generate a new token.
  2. The listener on port 4504 uses the Access Analyzer TLS certificate and doesn't start when that certificate has expired. If you replace the certificate with one that uses a different key pair, enrolled agents stop trusting the server; generate a new token and enroll each agent again.