Report Generation | Netwrix Product Documentation

📄️ Ad-Hoc and Email reports shows different results i

Explains why Password Expiration email reports and Ad-hoc reports can show different user counts in one-way-trust forest environments and how to grant the Data Processing Account read access to the Password Settings Container.

📄️ Alert Reported Change Made by System

Explains why an alert email may show "System" in the WHO field and how Netwrix Auditor later populates WHO and WHEN data from security event logs for daily reports and SQL reports.

📄️ Can any additional attribites be displayed in the

Shows how to configure SSRS-based reports in Netwrix Auditor to display additional Active Directory attributes (modification, created, and deleted reports).

📄️ Can't Find a File Share in a Report

Explains why file shares with spaces or hidden shares (ending with `$`) may not appear in activity reports and how to add them to a monitoring plan.

📄️ Can’t Find Info about Largest Files in the Files a

Explains how to view file sizes using the Largest Files Report (Reports > File Servers > File Servers - State-in-Time) when the Files and Folders Created Report does not show sizes.

📄️ Certificate-related and unauthorized errors occur

Describes certificate enrollment (RPC server is unavailable) and unauthorized access errors when running Netwrix Auditor reports, and provides troubleshooting steps and resolutions.

📄️ Changes are reported with incorrect timestamps and

If changes have incorrect timestamps or Change Summaries are sent outside the schedule, check the computer time settings and restart the Netwrix Auditor Service for SharePoint. Restarting the service resolves issues that occur after timezone or manual date/time updates.

📄️ Changes Reported in Wrong Time Zone

Explains why Netwrix Auditor reports show changes in an incorrect time zone and how to change the time zone on the SQL Server Reporting Services (SSRS) server. Also notes which reports are unaffected.

📄️ Error 500 when Viewing and Accessing Reports

Error 500 occurs when viewing or accessing reports in Netwrix Auditor due to SSRS service account misconfiguration. This article explains how to configure SQL Server Reporting Services to use the Network Service account to resolve the error.

📄️ Error 503 − Reports and Subscriptions Not Working

Troubleshoot Error 503 when reports and subscriptions in Netwrix Auditor fail. This article lists symptoms, causes, and step-by-step resolutions, including how to check and resolve an expired SSRS evaluation license.

📄️ Error During Report Processing — rsErrorImpersonat

This article explains how to resolve the "Cannot impersonate user for data source" error (rsErrorImpersonatingUser) when running reports in Netwrix Auditor, including checks for SSRS configuration, account permissions, and Audit Database credentials.

📄️ Error Generating a Report in SSRS − HTTP Error 401

Describes how to resolve "HTTP Error 401 - Unauthorized" when generating SSRS reports from Netwrix Auditor, including IE settings, IE Enhanced Security Configuration, SSRS permissions, Protected Users, Local Intranet settings, and rebuilding the Reports folder.

📄️ Error: "Scale-out Deployment" Is Not Supported in This Edition of Reporting Services

After migrating SQL Server or restoring the Report Server encryption key, Reporting Services may throw an rsOperationNotSupported error about "Scale-out deployment." This article explains the cause and gives steps to remove old encryption key entries from the Report Server database.

📄️ Exporting information on account lockout events

You can extract account lockout event details by parsing the `allinfo.xml` file in the product installation directory; account names are recorded as SIDs. For centralized collection across multiple computers, use Netwrix Event Log Manager.

📄️ Filtering reports by the user who made changes

Shows how to filter daily reports to see all changes made by a particular user using the Advanced Reports feature and Microsoft SQL Server.

📄️ Fixing reports displaying letters instead of command text in SSRS

When SSRS report toolbar icons render as text symbols, the problem is usually Internet Explorer permissions. This article explains how to add the reporting server to Trusted Sites and disable Protected Mode for Admins via Group Policy to restore the command buttons.

📄️ How do I exclude access events to the Calendar and

Explain how to exclude access events to the Calendar and Contacts folders from Netwrix Auditor reports by editing the mailboxestoexclude.txt file and ensuring the Compression service option is enabled.

📄️ How to exclude specific user accounts from reports

Describes how to exclude specific user accounts from Netwrix File Server Change Reporter change summaries and reports by editing omituserlist files.

📄️ How to exclude the Public Key Infrastructure (PKI)

Shows how to exclude Public Key Infrastructure (PKI) attribute changes from Netwrix Auditor reports by adding entries to the omitproplist.txt file in the product installation directory.

📄️ How to exclude user`s extended properties from bei

Add specific entries to the omitproplist.txt file in the Netwrix Auditor for SQL Server installation directory to prevent user extended properties from being reported.

📄️ How to filter out certain users from reports

Shows how to exclude specific users from mailbox access reports in Netwrix Auditor by adding them to the userstoexclude.txt file. Explains the file structure, wildcard support, and how exclusions affect stored snapshots and the Report Viewer.

📄️ How to filter out specific events from being monitored by the Netwrix Logon Reporter software?

Explains how to configure the ExcludeFilter.txt file in the Netwrix Logon Reporter installation folder to omit specific events from reports and Detail Reports.

📄️ How to modify SSRS report timeouts

How to modify SSRS report timeouts for Netwrix Auditor, including per-report and global execution timeouts, httpRuntime executionTimeout, and RSReportServer.config DatabaseQueryTimeout.

📄️ How to modify the recipient list for Activity Summ

Learn how to modify the recipient list for Activity Summary and Change Summary reports in Netwrix Auditor. This article explains how to add or remove recipients for a Monitoring Plan's notifications.

📄️ How to omit certain object changes from being repo

Explains how to exclude certain data from Server Configuration Change Reporter snapshots by using omit files such as `omit***.txt`, with examples of patterns you can use in `omitpathlist.txt`.

📄️ How to omit User Account Locked Out events from re

To exclude all "User Account Locked Out" events from reports in Netwrix Auditor, edit the `unomitproplist.txt` file in the Netwrix Auditor installation folder and remove or comment out the `*.lockoutTime` line.

📄️ How to prepare for printing SSRS-based reports

Learn how to enable and install the ActiveX Control required to print SSRS-based reports from Internet Explorer and Netwrix Auditor Client.

📄️ How to remove a decomissioned server from SSRS rep

Shows how to remove a decommissioned file server from the drop-down menu in SQL Report Manager by deleting the server's entry from the Sessions table in the NetWrix_File_Server_Change_Reporter database.

📄️ Troubleshoot Changes Listed as System

Troubleshoot when Netwrix Auditor change reports show "System" as the change initiator and list the domain controller as "unknown", including diagnostic steps and data to collect for support.

📄️ How to troubleshoot overwrites in change reports f

Learn how to troubleshoot overwrite warnings in VMware change reports by retrieving audit events with VMware PowerCLI and collecting logs to provide to support.

📄️ How to Use Wildcards in Netwrix Auditor Reports

Explains which SQL wildcards you can use in Netwrix Auditor reports and provides examples of matched results for each wildcard.

📄️ HTML reports have an issue with non-Latin characte

HTML summary reports may display non-Latin characters as question marks or symbols. This article explains why and how to fix it by changing the encoding to Unicode (UTF-8) in your email client or browser.

📄️ Impossible to Export a Report

Explains why you cannot export reports from Netwrix Auditor when Internet Explorer is not installed and lists workarounds to save reports via a browser, Report Manager (SSRS), or the Print feature.

📄️ Include Change Password Events by Users via Ctrl+Alt+Del

Shows how to include change password events performed by users through the Ctrl+Alt+Del key combination in Netwrix Auditor reports.

📄️ Incorrect data in reports without any warnings

If reports show no data or the `System` value in the **Who** column while Netwrix Auditor System Health shows no errors, this article explains possible causes and resolutions related to the Security event log on the file server.

📄️ Japanese Characters Missing or Displayed Incorrect

If Japanese characters are missing or displayed incorrectly in PDF reports, install the Japanese Supplemental Fonts on the client or server. This article explains how to add the optional font feature on Windows 10 and Windows Server 2016 and newer.

📄️ Logon Failed for Unattended Execution Account Runn

This article explains how to resolve the "Logon failed for the unattended execution account" error when running Netwrix Auditor reports by verifying execution account credentials in Report Server Configuration Manager or in the rsreportserver.config file.

📄️ Netwrix Auditor Risk Assessment Reports Reference

Reference table to find detailed information about Risks shown in the "Risk Assessment" Window by mapping each risk to its data source and the corresponding Netwrix Auditor report.

📄️ No data is present in reports, the Who field conta

Explains why reports, Change Summaries, or search results show no data or display the `System` value in the Who field, and how to enable or configure auditing to resolve the issue.

📄️ Object Deletion does not show up in alerts and rep

Describes how to modify permissions on the Active Directory Deleted Objects container so non-administrator accounts (used by Netwrix Auditor) can view deleted objects on Windows 2000/Server 2003 domain controllers.

📄️ Operation Has Timed Out for CEF Export SIEM Add-on

This article explains how to troubleshoot and resolve the "The operation has timed out" error when running the Netwrix Auditor Add-on for SIEM CEF Export PowerShell script.

📄️ Reporting Services Error: Cannot Check the Content

When you run the SQL Server Reporting Services Settings wizard during initial Audit Database configuration, you may receive an error stating the account is not granted the Content Manager role. This article explains the cause and points you to the software requirements to resolve the issue.

📄️ Reports for Subscriptions Are Missing in Netwrix Auditor

A scheduled report subscription sometimes does not send a report because the subscription is configured not to send empty reports when no activity occurred; enable the setting or adjust the schedule to include multiple days to resolve the issue.

📄️ Reports Generation Takes a While and Completes Wit

Predefined reports and subscriptions that query wide date ranges can be slow to generate and may complete with dataset or server errors. This article lists possible causes and step-by-step resolutions to address report timeouts and SQL Server memory issues for Netwrix Auditor.

📄️ Security Groups are Not Fully Displayed in the Azu

Explains why the Azure AD Accounts — Attributes report shows “XXX and more” for the Member of attribute and how to view the full group list using the Azure AD Accounts - Effective Group Membership report.

📄️ State in time reports do not show GPO settings val

State-in-time (SIT) GPO reports in Netwrix Auditor may show only summary information and omit most GPO settings when the Auditor VM is on a different subnet and the data processing account uses NETBIOS domain\account format. This article explains the affected environment, cause, and the resolution.

📄️ Subscription Reports Errors

Describes errors you may see when viewing subscription reports in Netwrix Auditor and provides steps to resolve them, including restoring the Reports folder and verifying SSRS authentication.

📄️ The Email Address column in the Enrollment report

Explains why the Email Address column in the Enrollment report is blank and how to enable Additional authentication using the user email so enrolled users have email addresses populated for password reset.

📄️ The product does not report on changes to Calendar

The Calendar folder is excluded from auditing by default to avoid reporting shared calendars as unauthorized non-owner mailbox access. This article explains how to include the Calendar folder in monitoring by editing the exclusion file.

📄️ Unable to Generate Reports After Migration

After migration, some Netwrix Auditor reports may fail with the error: "Unable to cast object of type 'System.Guid' to type 'System.String'". This article explains the cause and provides step-by-step resolution to recreate the reports folder and restore report generation.

📄️ Unable to Run Reports — System Cannot Find the Fil

This article explains how to resolve the "System cannot find the file specified" (0x80070002) rsInternalError when running reports in Netwrix Auditor, typically caused by a missing report server database. It lists symptoms, cause, and step-by-step resolution.