Skip to main content

Event ID 1244 in Health Log

Symptoms​

One of the following error messages under Event ID 1244 Unable to remove site collection %site_collection% from the auditing scope is prompted in Health Log for your SharePoint monitoring plan:

  1. Error 1:
Unable to remove site collection %site_collection% from the auditing scope:
Attempted to perform an unauthorized operation.
  1. Error 2:
Unable to remove site collection %site_collection% from the auditing scope:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).
  1. Error 3:
Unable to remove site collection %site_collection% from the auditing scope:
Access to this Web site has been blocked.

Causes​

  1. Error 1: Netwrix Auditor failed to remove the audited site collection from the auditing scope due to the Adding content prevented status. Alternatively, the Farm account or the service account for the web application pool hosting the audited site collection has been modified, and has not been granted the Log on as a batch job permissions in the server hosting SharePoint Central Administration.

  2. Error 2: Netwrix Auditor failed to remove the audited site collection from the auditing scope due to insufficient permissions for the web application hosting the target site collection.

  3. Error 3: Netwrix Auditor failed to remove the audited site collection from the auditing scope due to the No Access status.

Resolutions​

Review the resolution for the corresponding error:

  1. Error 1: In SharePoint Central Administration, navigate to Application Management > Configure Quotas and Locks > %affected_site_collection%, and change the status to Not locked.

  2. Error 2: In SharePoint Central Administration, navigate to Web Applications > %affected_application% > User Permissions, and verify the security settings. The minimum required permissions are Manage Web Site.

  3. Error 3: In SharePoint Central Administration, navigate to Application Management > Configure Quotas and Locks > %affected_site_collection%, and change the status to Not locked.

Learn more on management of the SharePoint site lock status via PowerShell in Manage Lock Status for Site Collections in SharePoint Server − Manage Lock Status for Site Collection via Microsoft PowerShell ⸱ Microsoft 🤝.