301 docs tagged with "kb"

This article provides a resolution for the "Hub connection failed" error due to an IP address being blocked after multiple login failures.

Explains how to troubleshoot LDAP connection and synchronization failures between the Netwrix Endpoint Protector Server and Active Directory domain controllers, covering credential, addressing, permission, network, and configuration causes.

This article outlines the installation and configuration paths for Netwrix Activity Monitor (NAM) 7.0, detailing the various locations and files used for the NAM agent and console.

This article explains how to resolve issues where Active Directory (AD) administrators are unable to log in after setting up AD Authentication and importing new admin accounts in Endpoint Protector.

Shows how to add a Palo Alto firewall as a proxied device in Netwrix Change Tracker. Covers SSH credential prerequisites, prompt regex configuration, and the login script directives current Gen 7 agents require.

Antivirus and endpoint detection and response (EDR) exclusions required for Netwrix Change Tracker agents and Hub to avoid performance degradation.

Use this article when you have replaced or edited a configuration or compliance report template and need to upload it to Netwrix Change Tracker. It covers uploading templates, overwriting defaults, and assigning templates to device groups.

Instructions to configure Endpoint Protector to allow ChatGPT by adding the `openai.com` domain to a Deep Packet Inspection (DPI) allowlist and including it in a Content Aware Policy.

Explains which antivirus exclusions to add for Netwrix Data Classification to prevent slowdowns and locked index or temporary files.

Step-by-step instructions to apply a compliance template to a group in Netwrix Change Tracker for automated reporting.

This article addresses whether Endpoint Protector recognizes iOS devices when connected to a Windows PC.

How to configure Postman to authenticate against the Privilege Secure Discovery (NPS-D) API using an API key and store the resulting JWT token as a global variable.

Overview of the Authorization Groups feature in Privilege Secure Discovery (NPS-D), including how to enable it, configure it, and understand its behavior and limitations.

This article describes how to back up the Netwrix Data Classification index (NDC) to provide a recovery point in case of index corruption and minimize downtime.

How to back up, restore, or move your MongoDB database used by Netwrix Change Tracker, including copying required files and troubleshooting the "Key not valid in specified state" error.

Best practices to prevent accidental internal and external data leakage when using Netwrix Directory Manager, including role-based scope limits, group creation controls, membership import methods, and mail-related safeguards.

Explains how to block file transfers to or from network shares by configuring the Content Aware Protection policy. Includes step-by-step instructions and examples for specifying network share paths.

This article explains how you can prevent access to EasyLock-protected folders from machines that do not have the Endpoint Protector agent installed, ensuring only endpoints with the agent can open EasyLock folders.

Explains whether Netwrix Endpoint Protector's Content Aware Protection can detect sensitive content inside archived files and how password protection affects scanning.

Yes. Endpoint Protector can block internal card readers on Mac by treating them as the USB Storage Device device class; set the class rights to Deny to block the reader.

Explains how to enable Optical Character Recognition (OCR) for file content inspection in Netwrix Endpoint Protector and lists supported file types and where to enable the setting.

Explains how to configure whether the EasyLock app requires the Netwrix Endpoint Protector agent to be installed before it can be opened and where to change the setting.

Explains how to block an internal card reader on a Mac using Netwrix Endpoint Protector (EPP) and how user remediation affects inserted SD cards.

This article addresses the error related to the certificate thumbprint mismatch in the Netwrix Agent and provides a resolution to ensure proper reporting to the Hub Server.

Resolving an issue where the Netwrix Change Tracker agent cannot start on RHEL 8 or 9 due to default cryptographic policy changes, by applying a custom subpolicy.

Describes what information to collect and provide to Netwrix Support when reporting an issue with Netwrix Change Tracker, including general details, Agent and ITSM module attachments, and Hub Server attachments.

Step-by-step instructions to reset the MongoDB admin account password when authentication is enabled and the admin password is lost. Requires access to the server hosting MongoDB.

Shows how to change the location where Netwrix Privilege Secure stores session recordings and web recordings.

This article explains how to check the version of the client installed on your computer, either directly from your computer or through the management console.

Explains how to safely clean up a stuck or unresponsive Audit Log Backup configuration on the Netwrix Endpoint Protector Server and recreate it, including how to back up log files before removing them.

This article explains the meaning of client integrity fail events and outlines their potential causes.

Describes the six client modes in Netwrix Endpoint Protector, their behavior, and recommendations for when to use each mode. Explains differences between Normal, Transparent, Stealth, Panic, Hidden Icon, and Silent modes and links to additional documentation.

This article explains how to run the Endpoint Protector diagnostic collection script directly on a Windows or macOS endpoint to gather debug logs when the EPP Client cannot communicate with the EPP Server.

Shows how to resolve an AD, Entra ID, or Okta collection scan stuck in Running status in Netwrix Identity Recovery by updating the TaskInstances table and restarting the Task Server service.

Explains how to complete an offline installation of GroupID 11.1.6 by temporarily allowing Windows to verify the installer's code-signing certificate before reverting to a fully offline environment.

If compliance reports in Netwrix Change Tracker show Status as Processing with a percentage that never reaches 100%, an IIS request-filtering tool such as UrlScan may be blocking the Transfer-Encoding header. This article explains the cause and the fix.

Explains how to resolve the "Hub location details have not been specified" error when an agent cannot find HubDetails.xml, including running the connection script and manually editing HubDetails.xml.

This article explains how to configure priorities for content aware policies in Endpoint Protector, ensuring the correct enforcement of rules for sensitive content detection.

Configure session timeout settings for the Netwrix Endpoint Protector administration interface to control how long user sessions remain active and to set the timeout warning behavior for inactive sessions.

Configuring File Approved Safe Technology (FAST) in Netwrix Change Tracker by creating a Planned Change rule set with a FAST Match rule.

Supported TLS versions for in-transit encryption and MongoDB at-rest encryption options for Netwrix Change Tracker.

Shows how to enable recursive file content monitoring by editing the Change Tracker web server configuration and applying the filter to a configuration template in Netwrix Change Tracker.

Step-by-step instructions to configure rights for Outside Hours and Outside Network in Netwrix Endpoint Protector, including how to enable policies, set working hours, define DNS settings, and configure fallback rights.

Describes how to configure stopwords used by Netwrix Data Classification and explains the two stoplist tables in the NDC SQL Database.

This article describes how to configure Netwrix Auditor and SQL Server to communicate via a secure channel using TLS 1.2.

Explains how to create and configure Content Aware Policies to detect sensitive content, set thresholds, and control data exit points across operating systems.

This article explains why the Content Aware Protection (CAP) tab may be missing from the Endpoint Protector Console and provides troubleshooting steps.

If Netwrix Change Tracker events reports contain ErrorEvent entries labeled "Corrupt", multiple conflicting agent configuration files may be present on affected devices. This article explains how to identify affected agents and perform an agent reset to resolve the issue.

This article outlines the steps to create a backup of all settings, rights, policies, and integrations for disaster recovery or migration purposes.

This article explains how to exclude specific file extensions from being traced, scanned, or shadowed in Endpoint Protector.

Shows how to create a custom tracked attributes filter within a Netwrix Change Tracker configuration template when no default filter matches your requirements.

This article explains how to create custom eDiscovery policies and manage scans in Netwrix Endpoint Protector, including how to define scan types, configure scan intervals, and review scan results.

When Thales SafeNet MFA and the Netwrix Password Policy Enforcer Client are installed on the same system, the Password Policy Enforcer Client does not display policies and Thales MFA may not function correctly. This article explains the cause and provides a registry fix.

Netwrix Data Classification (NDC) supports encryption for sensitive data at rest and in transit, including credentials, tokens, and API keys. This article describes NDC's encryption methods, authentication support, and deployment considerations.

This article explains how to deploy Endpoint Protector client software to Windows computers using Active Directory Group Policy Objects (GPO).

This article explains how to deploy the Netwrix Endpoint Protector client on macOS using Intune and how to configure full disk access for the client.

This article explains how to deploy Endpoint Protector agents to endpoint systems and provides platform-specific steps, including macOS Full Disk Access configuration.

This article explains why the Destination Details tab may be missing in the Reports and Analysis section of the Endpoint Protector Console and how to resolve the issue.

Use the UI indicators and provided scripts to determine whether the default agent account password is in use on the Netwrix Change Tracker Hub. Includes PowerShell and Bash scripts for versions prior to 7.7.4 and guidance for versions 7.7.4 and later.

Describes which network ports to open to allow Netwrix Change Tracker agents and servers to communicate, including ports for agentless monitoring and network device configuration.

Describes the sections within the Device Control module of Netwrix Endpoint Protector and explains how to manage devices, computers, users, groups, global settings, and custom device classes.

Describes how to disable two-factor authentication (2FA) for the default administrator user in Netwrix Change Tracker so one-time codes are written to the server log for Allowed Commands.

This article explains the purpose of `core.*` files in Gen 7 Agent servers and whether they can be safely deleted to free up disk space.

Explains whether Endpoint Protector can inspect email content sent through Thunderbird and how Thunderbird version affects inspection capabilities.

This article addresses whether the "Uninstall Attempt" event confirms the removal of the agent from the client machine.

The DPI certificate may not appear in the browser when no Content Aware Policies (CAP) are applied. This article explains the cause and shows how to configure CAP so the DPI certificate is deployed to monitored browsers and applications.

Learn how to enable Deep Packet Inspection (DPI) and configure text inspection for instant messaging applications in Netwrix Endpoint Protector.

This article explains how to enable EasyLock application updates and file shadowing for removable drives using the Endpoint Protector web console.

Learn how to enable Sensitive Data Protection on the Netwrix Endpoint Protector (EPP) Server by setting an additional security password to protect sensitive sections of the server.

This article explains how to enable two-factor authentication (2FA) for system administrators using the Google Authenticator App in Endpoint Protector to enhance account security.

Shows how to configure Netwrix Change Tracker to lock a user account after repeated failed login attempts, by setting lockoutenabled to true in appsettings.json. This overrides the previous IP-blocking behavior, which is no longer used.

Shows two methods to enable debug-level logging for the Threat Prevention Admin Console on the SI management server and how to revert logging back to WARN after you collect logs.

Shows how to enable Advanced Printer and MTP Scanning in Netwrix Endpoint Protector to improve Printer and MTP content-aware file tracing and shadowing, reducing false positives for browser and application file transfers.

Shows how to enable baseline events on monitored folders in Netwrix Change Tracker and explains what baseline events are and how they appear on the hub.

Shows how to enable debug logging for the Netwrix Threat Prevention Windows agent by editing the agent log config or updating log levels from the Threat Prevention Administration Console.

Describes how to enable Deep Packet Inspection and intercept VPN traffic on macOS clients with Netwrix Endpoint Protector. Includes steps to install the DPI certificate, allow the system extension, and configure VPN interception settings.

Shows how to enable User Remediation in Content Aware Protection policies so end users can justify or remediate blocked actions when a policy triggers in Netwrix Endpoint Protector.

Resolving Error 503 when the Netwrix Change Tracker login screen is unavailable due to the web application pool not running or incorrect application pool identity credentials.

This article explains why the notification "Cannot execute command! An error occurred!" appears in the Endpoint Protector Server UI and how to resolve it.

Resolve the Access Denied (0x80070005) error that occurs when registering the RSAT Extension in the Netwrix Identity Recovery Configuration Utility by delegating the required Active Directory write permissions.

Fixes a 404 error when accessing the Netwrix Change Tracker API Metadata page by enabling the plugins.metadataenabled key in appSettings.config.

This article addresses the error "Cannot connect to identity store" when using Group Managed Service Accounts (gMSA) in Directory Manager, detailing the symptoms, causes, and resolutions.

Steps to configure permissions so a user running the Password Policy Enforcer Management Console can read and write the Password Policy Enforcer configuration.

Shows how to troubleshoot computers that appear as "Unlicensed" in the List of Computers by verifying licenses, updating policies, checking client-server connections, and reassigning licences or reinstalling clients.

This article addresses the issue of new devices not appearing in the List of Devices on a protected computer and provides troubleshooting steps to resolve the problem.

Explains why macOS shows "Failed to initiate USB device" when launching EasyLock from Finder with read-only access enforced, and how to launch EasyLock using the Netwrix Endpoint Protector Client or Notifier.

When adding a group Managed Service Account (gMSA) connection profile in Netwrix Access Analyzer, the console displays "GMSA error: Access is denied." This article explains the cause and provides steps to grant the console account permission to retrieve the gMSA password.

When an agent with the same name as an already registered agent attempts to connect to Netwrix Change Tracker, the hub can return a 500 error indicating the requested agent name is in use. This article explains how to resolve the error on Windows and RHEL/CentOS by restoring the correct agent ID and editing HubDetails.xml.

Describes how to fix the "Secure Connection Failed (Invalid Certificate)" error in Mozilla Firefox when accessing Endpoint Protector by removing certificate entries related to the appliance. Explains certificate-related changes and provides steps to resolve the issue.

This article explains how to resolve an issue where the Endpoint Protector Server user interface (UI) is only accessible using the Safari web browser when the server is hosted on a virtual machine (VM).

When you run the Netwrix ChangeTracker Gen7 Agent NetCore installer and test the Hub connection, you may receive a WinHttp.WinHttpRequest error stating the connection was terminated abnormally. Install Microsoft's Easy Fix update to enable TLS 1.1/TLS 1.2 for WinHTTP to resolve the issue.

A template for gathering and providing information needed to investigate and escalate Privilege Secure Discovery (NPS-D) issues, including problem summary, evidence, timeline, and reproduction steps.

Resolving the "Error, the requested event counts summary size cannot be smaller than the system event count window size" message in Netwrix Change Tracker by correcting the EventStatsUnitSeconds configuration value.

Resolves the 'WinRM Shell client cannot process the request' error in ExchangePS data collector jobs by updating the PackageManagement and ExchangeOnlineManagement PowerShell modules to supported versions.

Shows how to exclude or edit lines from process output tracking on agentless devices using the ExcludeMatchesWithComment login script directive, so that always-changing values such as uptime do not generate change events.

Learn how to export selected event logs from the Reports and Analysis section in Endpoint Protector for further analysis or record-keeping.

Shows how to export or back up individual MongoDB collections used by Netwrix Change Tracker. Includes commands to view collections and use mongodump for exporting collections.

Steps to export Netwrix Data Classification event logs from Windows Event Viewer so you can collect and share logs for troubleshooting.

Exporting events from the Netwrix Change Tracker Events page to CSV, PDF, or XLSX format.

Resolving the "file is being used by another process" error when running a report in Netwrix Change Tracker, typically caused by antivirus or EDR solutions locking the report file.

Explains the file shadow formats Endpoint Protector saves for printed documents when Advanced Printer and MTP Scanning is enabled, including the default ` .txt ` representation and possible original-format ` .pdf ` files.

Shows how to resolve the "Check Log for Details" message by verifying and reinstalling the NNTInfo driver and explains kernel buffer limitations that can cause intermittent loss of "who made the change" information.

Steps to validate and update the Fluentd configuration to forward logs from Privilege Secure Discovery (NPS-D) to a SIEM, including backup, update, and service restart procedures.

When an Easylock administrator role is assigned to an administrator group, the Global rights option does not appear in the Device Control submenu. This article explains the cause, confirms that this is expected behavior, and provides steps to reproduce and options to request a change.

The affected computer appears greyed out and cannot be selected in the Netwrix Endpoint Protector client software upgrade interface because it is already assigned to another active upgrade job. This article explains how to identify and resolve the issue so you can select the computer for a new upgrade job.

Explains how the File Size Threshold controls individual file uploads in Netwrix Endpoint Protector's Content Aware Policies and how it affects multi-file uploads.

This article explains how EasyLock software integrates with the Endpoint Protector Server and Client software, detailing the steps to configure and use it effectively.

Explains how the File size threshold setting limits uploads per individual file rather than by aggregate, with an example showing allowed and blocked uploads.

This article explains how to add a new entry to the Justification List in Endpoint Protector (EPP) and apply it to a Content Aware Protection policy for user remediation.

This article provides step-by-step instructions on how to add an SSL certificate to Endpoint Protector.

This article explains how to add specific devices to the allow list using the web console interface.

This article explains how to apply an offline patch or upgrade to Endpoint Protector (EPP) when the appliance does not have direct internet access or when you need to control the timing and process of software updates.

This article explains how to use the Security Backend Updates section in Endpoint Protector to check for and apply security updates.

If you are experiencing issues with Easylock, back up the data on your USB drive using these step-by-step procedures to secure your files and restore access.

This article explains how to block source code in images by enabling Optical Character Recognition (OCR) and configuring a Content Aware Protection policy.

This article provides step-by-step instructions on how to block specific IP addresses from accessing the console by configuring login IP restrictions for the administrator account.

Learn how to block the WhatsApp application from launching on Windows and macOS by configuring an Applications Denylist in the Content Aware Protection policy of Netwrix Endpoint Protector.

This article describes how to boot the Endpoint Protector On-Prem appliance into recovery mode to change the epproot user password and optimize the appliance configuration for Nginx, MySQL, and PHP-FPM. These steps apply only to on-premises deployments.

Shows how to change the default IIS port used by the Netwrix Data Classification Web Console by editing site bindings in IIS Manager.

Use the ConfigPath switch in expressAgent.ini to change the Express Agent database and log files location on Netwrix Change Tracker.

Explains whether you can charge an iPhone on a computer managed by Netwrix Endpoint Protector and which device permissions allow charging.

Use this article to verify the connection between the Netwrix Endpoint Protector Client and the server. It explains how to view the last connection time, server IP and port, connection status, and when policies were last received.

Use these steps to check alert history, view log and alert details, and verify whether an email was successfully sent from the Netwrix Endpoint Protector Server.

This article explains how to collect extended Deep Packet Inspection (DPI) logs on MacOS to assist with troubleshooting and support requests. Use the provided script to generate a tar archive that you can attach to your support ticket.

Instructions to collect extended Deep Packet Inspection (DPI) logs on Windows for Netwrix Endpoint Protector using the official DPI log collection tool.

Use the Deny Access but Allow Charging right to allow iOS devices to charge while access is denied. This article shows where to configure this setting in the Netwrix Endpoint Protector Console and provides important notes about its behavior.

If you use a proxy on your Netwrix Change Tracker Server and FAST Cloud does not work, configure the proxy for IIS processes by adding a system environment variable. This article shows the exact steps to set the ALL_PROXY variable.

This article explains how to configure user remediation for Device Control in Netwrix Endpoint Protector, including global, group, and device-level settings. It also shows how to configure remediation pop-ups, justifications, and device-specific rights.

This article provides step-by-step instructions on how to control iDevices such as iPhones, iPads, and iPods Touch within Endpoint Protector on Mac computers.

This article explains how to deploy the Endpoint Protector client to Windows endpoints using Microsoft System Center Configuration Manager (SCCM) or the msiexec command-line tool.

Describes how to deploy the Netwrix Endpoint Protector Windows agent manually, silently, or via Group Policy, including installer filenames, MSI properties, and example commands.

This article explains how to display the Destination URL in Content Aware Reports in Endpoint Protector.

This article explains how to boot the Endpoint Protector On-Prem appliance into single-user (recovery) mode and safely expand disk space by resizing partitions and the file system after increasing virtual disk capacity.

This article explains how to export the list of computers, users, or devices from the console, including both manual and scheduled export options.

This article provides guidance on locating the CoSoSys Team ID and Bundle ID necessary for deploying the Endpoint Protector Client on macOS.

This article explains how to configure your system to generate a memory dump file after a system crash. It shows the Windows settings you must set to collect kernel or complete memory dumps.

This article explains the purpose and handling of the 111.33.33.111 IP address configured on the Endpoint Protector (EPP) server, along with important considerations for firewall and routing settings.

Learn how to identify and remove duplicate computers in Netwrix Endpoint Protector to free up licenses. This article walks you through filtering for duplicates and deleting unwanted entries.

This article explains how to increase the maximum number of records displayed in report searches in Endpoint Protector.

Learn how to install the Netwrix Endpoint Protector client silently from the command line without user interaction or a system restart.

This article provides step-by-step instructions for installing the Endpoint Protector Linux client.

This article explains the default credentials for the Endpoint Protector Reporting and Administration Tool and how to change them after initial setup.

This article provides step-by-step instructions for manually uninstalling the agent on various operating systems.

Shows you how to enable the Monitor webmail setting in Netwrix Endpoint Protector so the product can scan subject and body fields for Gmail, Outlook, and Yahoo webmail accessed through browsers.

This article provides step-by-step instructions for performing a backup restore for Endpoint Protector, ensuring data security and system integrity.

This article provides step-by-step instructions on how to reassign a valid Enforced Encryption license from the server to a USB storage device.

This article provides step-by-step instructions to resolve issues with the Reports and Analysis logs not loading in Endpoint Protector by adjusting display settings.

Shows how to run an events report that includes Created Planned Changes, Approved Changes, and the user who performed these actions in Netwrix Change Tracker.

This article explains how to select multiple computers and users within a static group using the multi-selection feature in the Endpoint Protector console.

Explains why the Read Only access right is unavailable for iPhone devices and lists the supported access rights you can assign.

This article explains how to configure an uninstall protection password in Netwrix Endpoint Protector so that only authorized users can remove the client from managed devices.

Shows how to configure the server certificate subject to use the Fully Qualified Domain Name (FQDN) and how to regenerate the server certificate stack so the new subject takes effect.

This article explains how to synchronize Active Directory (AD) administrator accounts using the AD Authentication feature, allowing for efficient management of administrator accounts.

This article explains how to configure e-mail alerts in Endpoint Protector, including setting up the e-mail server and creating alerts for various system events.

This article outlines how to configure external storage to conserve hard drive space on the server by directing shadows and backups to a remote location.

This article explains how to configure SMTP settings in Endpoint Protector to use Gmail as your email provider, including required configuration values, steps for generating an app password, and instructions for sending a test email.

This article explains how to stage the Endpoint Protector Server before deploying the Endpoint Protector agent to endpoint systems.

Instructions to find the current version and update Netwrix Endpoint Protector or Unify Server using Live Update or the Offline Patch Uploader, and how to verify applied updates.

This article explains how to update to macOS 12 (Monterey) while using the Endpoint Protector client and Deep Packet Inspection, ensuring compatibility and proper certificate configuration.

This article explains how to upgrade from Endpoint Protector Server v5.8.0.0 to v5.8.1.0 when the Apply Updates button is grayed out after selecting available Endpoint Protector (EPP) software updates.

This article shows how to upload a compliance/tracking template to Netwrix Change Tracker using the Settings > Policy Templates page, with step-by-step instructions.

Explains how EasyLock behaves on a computer that does not have Netwrix Endpoint Protector or its client software, and how you can access encrypted data using a password and FIPS 140-3 validated encryption.

This article explains how to use the Content Detection Summary section in Endpoint Protector (EPP) to manage content detection rules effectively.

This article explains how to locate your scanner in the controlled device list within the Endpoint Protector Console.

Netwrix Endpoint Protector limits report displays to 10,000 entries; this article explains how you can view all eDiscovery scan results when the results exceed that limit by using filters or creating an audit log backup.

This article explains how to globally whitelist a specific device in Endpoint Protector (EPP) by creating a custom class. You will learn how to identify devices using attributes and configure access permissions.

Resolves HTTP/HTTPS Error 500.19 caused by a duplicate X-Frame-Options collection entry in web.config after upgrading Netwrix Change Tracker from an older version.

Netwrix Identity Recovery uses several distinct accounts for installation, console access, domain and forest backup, RSAT Extension registration, and cloud tenant recovery. This article identifies each account, where it is configured, and the minimum permissions it requires.

Instructions to increase the File Content Max for extension setting on the Netwrix Change Tracker agent when file contents are not tracked because a file exceeds the configured size limit.

Instructions to increase the File Hash Max for extension setting on the Netwrix Change Tracker agent when a file hash is not calculated because a file exceeds the configured size limit.

This article explains how to ensure all prerequisites are in place and how to install the Endpoint Protector (EPP) Client on macOS endpoints with Deep Packet Inspection (DPI) and VPN Traffic Intercept active.

Shows how to install GlobalSign and DigiCert root certificates on Windows to resolve digital signature errors when installing the Netwrix Endpoint Protector Client and components.

This article explains what you need and what to expect when you install a monitoring agent on the virtual appliance, including NDA and support considerations.

This article explains how to install the Endpoint Protector agent on a Linux system that uses a proxy server.

This article explains how to install the Netwrix Endpoint Protector (EPP) agent on macOS when you use a proxy server, and how to configure proxy settings so the agent can communicate through your proxy environment.

Use this article to install the Netwrix Endpoint Protector agent on Windows in environments that require a proxy. It explains the proxy settings to enter during installation and how to verify the agent appears in the console.

Learn how to locate logs in the Content Aware Report when partitions are used so you can find results that may be stored on a different partition.

This article provides the default username and password for the Reporting and Administration Tool and recommends changing them immediately after setup.

Describes the current limits and system requirements for the Access Reviews integration with Windows File Servers in Netwrix Auditor, including maximum permission count and memory consumption.

Describes how to manage Enforced Encryption settings in Endpoint Protector, including master password configuration, password complexity rules, and Enforced Encryption file tracing (including Offline File Tracing and File Shadowing).

Learn how to locate and modify access rights for Network Shares in Endpoint Protector Device Control. This article explains the permission model, priority order, and specific restrictions that apply to Network Shares on Windows and macOS.

Shows how to view, create, and manage system administrators and administrator groups in Netwrix Endpoint Protector, and how to configure related account settings, roles, and two-factor authentication.

This article provides step-by-step instructions for manually activating debugging logs on Windows for the Endpoint Protector Client.

This article explains how to generate the log file and DPI log file for the Endpoint Protector (EPP) Mac Client using terminal commands.

Instructions to manually configure SharePoint Online auditing by creating an Entra app and granting permissions, importing certificates, and configuring Netwrix Access Analyzer and Netwrix Activity Monitor.

Explains how to troubleshoot Microsoft Entra ID synchronization failures in Netwrix Endpoint Protector, covering client secret, application and tenant ID, API permission, network, and configuration causes.

Explains that migrating Netwrix Data Classification to another server requires Netwrix Technical Support assistance and how to contact them.

Step-by-step procedure to migrate a Netwrix Auditor instance to a new server, including exporting/importing configuration, moving the Long-Term Archive, and handling SQL databases.

Steps to diagnose and resolve issues where devices do not appear in the client list for Netwrix Endpoint Protector by checking certificates and digital signatures.

Resolves a MongoDB connection timeout for the Netwrix Change Tracker Hub by increasing the IIS pool size and MongoDB connection timeout in appsettings.Production.json.

Shows how to troubleshoot a MongoDump failure caused by a Windows socket buffer issue and links to Microsoft guidance for resolution.

Explains how to resolve MongoDB "out of memory" errors by configuring Windows virtual memory (page file) to System managed so the Netwrix Change Tracker database and Hub Server can function properly.

Provides steps to repair a corrupted MongoDB database that causes the MongoDB service to stop repeatedly for Netwrix Change Tracker.

How to configure Netwrix Change Tracker to monitor Oracle databases. This article covers required connection details, creating database credentials, proxy device setup, running test compliance reports, and common Oracle error troubleshooting.

Shows how to move indexed files (CSE files) used by Netwrix Data Classification from one drive to another, including stopping services, copying files, updating configuration, and restarting services.

Instructions to migrate a MongoDB database used by Netwrix Change Tracker from a Linux Hub server to a Windows Hub server, including exporting on Linux, restoring on Windows, and resolving the "Key not valid in specified state" error.

This article explains how to resolve the Netwrix Auditor MSP license out-of-compliance error in proxy environments by configuring Call.Home.exe with explicit proxy settings, populating MSP.xml, and adjusting the MSPStartDelayerEnabled registry value.

This article lists the network ports used by Netwrix Endpoint Protector Server and Client and explains firewall configuration required to ensure proper communication, updates, and Active Directory integration.

Resolves a "Permission denied" error when running the NNT_FILEHASH_LINUX_X64 binary on agentless Linux devices monitored by Netwrix Change Tracker.

Provides the Netwrix Privilege Secure for Access Management-specific causes and resolutions for authentication failures after Microsoft KB5082142 changes the default Kerberos encryption type to AES-only.

Explains why old or duplicate events appear as new in syslogs and shows how to remove pending notifications from MongoDB to prevent re-reporting of outdated events in Netwrix Change Tracker.

This article explains why Optical Character Recognition (OCR) may not be functioning in Endpoint Protector and provides steps to resolve the issue.

This article describes the remediation options available after completing an eDiscovery scan in Endpoint Protector, helping to mitigate risks associated with sensitive data discovered on endpoints.

Resolving the "Number of pages in the report will exceed 250" error in Netwrix Change Tracker by increasing the MaxPagesInReport configuration setting.

Describes how to rebuild corrupted indexes on a single Distributed Query Server (DQS) by replacing CSE files and reindexing the affected content to avoid rebuilding indexes on multiple servers.

Steps to configure Fortinet Authenticator to work with Netwrix Password Policy Enforcer Client by adding the Password Policy Enforcer Client GUID to the Fortinet CredentialProvidersWhiteList registry value.

Explains why the PPE Password Policy Client displays a generic rejection message and no PPE event is logged when a password change fails, and how to resolve it by disabling Windows password policy rules.

If the Password Reset link is missing in the Netwrix Password Reset client and Duo MFA and Password Policy Enforcer Client are both in the environment. This article explains the steps and registry settings needed to get Password Reset Client, Password Policy Enforcer Client, and Duo MFA working together.

When using Netwrix Password Policy Enforcer Web, the website downloads PPEWeb.dll instead of loading pages.

Preventing Netwrix Change Tracker from recreating default OS groups after deletion by adding the CreateDefaultGroups configuration item.

This article explains how to ensure that printing jobs are properly blocked or reported by the Endpoint Protector (EPP) agent.

This article explains how you can secure the Netwrix Endpoint Protector (EPP) client on endpoint machines against unauthorized uninstallation by using an uninstall password and Tamper Mode.

Re-registering a device that was previously deleted from Netwrix Change Tracker using the Agents and Devices settings page.

This article explains why the Read Only access right may not function as expected after changing access rights and provides guidance on how to ensure the correct permissions are applied.

This article provides recommendations for ensuring seamless interaction between Endpoint Protector and various security vendors, proxies, cloud access security brokers (CASBs), and web browsers.

Explains why the Netwrix Endpoint Protector Server can return recurring HTTP 500 errors that clear only after a full reboot, and how to resolve the underlying sizing issue rather than repeatedly rebooting.

The Recovery Configuration Utility shows "RSAT Extension: Registered" as soon as any user registers it once, but that status only reflects the forest of whoever ran the registration. This article explains why the status label can be misleading in multi-forest environments and how to verify what is actually registered.

Explaining what Redis QFork.dat files are, where they are stored for Netwrix Change Tracker, and when it is safe to delete them to recover disk space.

Explains how to reduce the number of false positives by enabling and configuring global Contextual Detection in Netwrix Endpoint Protector.

Registering the RSAT Extension in Netwrix Identity Recovery only affects the forest of the account currently logged into the machine running the Configuration Utility. This article explains why registration does not carry over to a second domain or forest joined by a trust, and how to register it correctly in each one.

Shows how to uninstall and reinstall the Netwrix Endpoint Protector client on Linux using terminal commands, and how to resolve missing dependency errors.

This article explains how to remotely enable debug logging on an endpoint machine and collect client logs from the server interface, without requiring input or knowledge from the endpoint user.

Shows how to reset an administrator password on the Netwrix Endpoint Protector Server for local administrators; administrators imported from Active Directory must have their passwords managed in Active Directory.

Instructions to reset the default admin password on Netwrix Change Tracker when the reset API is accessible only from the localhost on the Hub server.

Learn how to prevent a black screen when accessing a machine remotely by adjusting Content Aware Protection (CAP) policy settings in Netwrix Endpoint Protector.

This article explains how to resolve HTTP Strict Transport Security (HSTS) errors that may occur in web browsers when accessing websites.

Explains why setting WiFi rights to Allow Access does not immediately enable WiFi on a computer running the Endpoint Protector client and what to do.

This article explains how to restart the Endpoint Protector (EPP) client on Windows, macOS, and Linux without restarting the computer.

How to restore a GPO's actual settings from an Identity Recovery GPO backup using the Group Policy Management Console (GPMC).

Learn how to block or disable specific applications or CLI commands by creating an Applications denylist in Netwrix Endpoint Protector policy settings.

Using the Planned Change Wizard to create a planned change schedule and resubmit unplanned events in bulk in Netwrix Change Tracker.

Configuring Netwrix Change Tracker to retrieve baseline events (file lists and hashes) after an agent or server restarts.

This article explains how to review the activity of administrators in the Endpoint Protector console using built-in reports.

This article explains how to resolve the "AgentTaskRunner - task execution failed for task 11 - TrackerPollTask-Baseline-processtracker-88" error in the Rolling Log by adjusting the policy template in Netwrix Change Tracker.

Explains the cause and resolution for a Rolling-Log error where AgentTaskRunner fails due to a mismatched path-match type in a policy template in Netwrix Change Tracker.

Explains the "FileContentTrackerDataCollectorLocal - couldn't locate File entry" rolling-log message in Netwrix Change Tracker, when it is safe to ignore, and how to troubleshoot if the file should exist.

Explains the "Hub Offline, connection retries exhausted" rolling-log error for Netwrix Change Tracker agents and how to troubleshoot connectivity between the agent and the Netwrix Server.

Shows how to fix the Rolling-Log error "HubDetails - Crypto error. Has the agent process account changed since the password data was entered?" by repairing the HubDetails.xml file used by the Netwrix Change Tracker agent.

Explains the Rolling-Log error where ItemStoragePipeline cannot collect a file's SHA256 hash because the file is missing, and provides guidance and troubleshooting steps for Netwrix Change Tracker.

Explains the RegistryTrackerDataCollector error that indicates the Netwrix Change Tracker agent cannot access a registry key, why the error appears, and how to troubleshoot or safely ignore it.

When Netwrix Password Policy Enforcer Client is installed on endpoints with RSA MFA, users can bypass RSA MFA by allowing users to log in to the machine using username and password.

This article explains how to add an SSL certificate to Endpoint Protector using the web interface to secure communications between clients and the server.

This article explains how to change the validity period for administrator passwords or remove password expiration entirely.

Learn how to set or remove rights for a specific device in the Netwrix Endpoint Protector console. Follow step-by-step instructions to assign or revoke device rights for users, computers, or groups.

This article explains how to set up a Report Only Content Aware Protection (CAP) policy in Endpoint Protector, allowing you to monitor file movement across endpoints without enforcing restrictions.

This article provides step-by-step instructions for setting up a SIEM integration with Endpoint Protector.

Learn how to set up URL allowlists and denylists in Netwrix Endpoint Protector, and how to apply them to users and computers. This article covers enabling Deep Packet Inspection and configuring Domain and URL lists for blocking or allowing uploads.

This article provides step-by-step instructions on setting up the Automatic License Release feature in Endpoint Protector to manage inactive licenses effectively.

Configuring syslog integration to forward Netwrix Change Tracker events to a Security Information and Event Management (SIEM) solution.

Explains how to check whether the syslog-ng service is running on the Netwrix Endpoint Protector Server when a SIEM integration stops receiving events, and what to do if restarting the service does not resolve it.

When Netwrix Password Policy Enforcer Client is installed on endpoints, the Smart Card Reader may become the default logon method instead of username/password due to Microsoft Windows behavior.

Resolves SSL/TLS certificate validation failures in Netwrix Directory Manager Admin Center after an upgrade, including expired, revoked, self-signed, and incomplete-chain certificate scenarios.

When Password Policy Enforcer (PPE) Server and Fortinet are installed on the same Domain Controller, Fortinet can take over the SubAuthentication registry value, which will prevent PPE from informing Windows to display password expiry notifications. This article explains the cause and provides registry edits to restore PPE functionality.

This article outlines the platforms on which Endpoint Protector Server can be installed, including deployment methods and supported environments.

Explains that System Backup V2 is a Self-Hosted-only feature, unavailable on the Netwrix SaaS platform because backup for SaaS deployments is managed by the Netwrix team.

Resolving "System Error" messages when running event queries with text search in Netwrix Change Tracker by switching to regex search and increasing query timeouts.

This article provides troubleshooting steps for resolving issues with Two-Factor Authentication (2FA) in Endpoint Protector, focusing on time synchronization and alternative setup methods.

Summarizes the most common issues encountered after migrating the Netwrix Endpoint Protector Server to the current image-based platform (2510/2604), grouped by EPP Server and EPP Client, with links to the full troubleshooting guide for each.

Shows how to configure Netwrix Change Tracker to send a separate real-time email notification for each change, instead of compiling multiple changes into a single email.

When you sort the My Groups listing by Display Name in Netwrix Directory Manager 11, groups that lack the Display Name attribute can prevent correct alphabetical sorting. This article explains the causes and steps to populate Display Name so the portal sorts correctly.

Resolving the "System Error / An unknown error occurred" message when uploading agent updates in Netwrix Change Tracker by increasing the IIS maxAllowedContentLength value.

Defines support levels for Password Policy Enforcer versions, including which versions receive bug fixes, security patches, and configuration assistance.

Describes the files stored in the Netwrix Change Tracker Gen 7 NetCore agent installation path, including Events.db, Config.xml, Rolling-log.txt, and HubDetails.xml.

Explains what Microsoft KB5082142 changes in Kerberos encryption defaults, why most environments are unaffected, and where accounts can still be relying on RC4.

This article explains the rights hierarchy for devices in Netwrix Endpoint Protector and how permissions are applied and overridden. It also shows how to set precedence between Computer and User rights and explains Custom Classes.

Use the provided uninstall script to remove the Netwrix Endpoint Protector client from a Mac computer. The steps explain how to run the `remove-epp.command` file and what to do if you don't have the installation kit.

This article explains how to uninstall previous versions of Netwrix Directory Manager to upgrade to the latest version and how to completely remove Netwrix Directory Manager from a machine.

Uninstalling the Netwrix Change Tracker agent using the silent uninstaller executable via PowerShell for both NetCore and non-NetCore installations.

Shows how to update the ransomware extension list when the appliance has no internet access. Explains how to copy the CryptoBlocker KnownExtensions data to `filters.json` and increment `filters.metadata` to force reprocessing in Netwrix Threat Manager v2.8+.

Learn how to review and change the Netwrix Endpoint Protector (EPP) server IP address, communication port number, or department code on a Windows endpoint without reinstalling the client.

Comprehensive guide for updating Netwrix Change Tracker agents from the Hub console, including download instructions, upload procedures, deployment scheduling, phased rollout strategies, testing recommendations, and troubleshooting.

Answers common questions about upgrading and migrating Netwrix Access Analyzer, including in-place OS upgrades, migration order, and SQL Server recovery mode recommendations.

This article explains how to upgrade the Endpoint Protector client on Linux without performing a full uninstall and reinstall, preserving configuration variables from the previous build.

This article addresses performance issues related to the Endpoint Protector Console/User Interface, detailing symptoms, causes, and resolutions.

This article explains how to locate and review logs of end user responses to User Remediation interventions in Endpoint Protector.

Explains additional uses for baseline data in Netwrix Change Tracker beyond individual file change detection, including retaining full configuration records for network devices and firewalls, and points to the Baseline Center documentation for building and running a Baseline Policy.

Use Smart Groups in Netwrix Endpoint Protector to automatically assign computers and users to groups based on property-based rules. Configure conditions across properties like Computer ID, Username, Department, and OS, then synchronize entities to keep group membership current without manual intervention.

Supported special characters for Netwrix Change Tracker user and agent passwords, and how to configure local password requirements.

Explains how to configure, check for, and apply updates using the Live Update feature on Endpoint Protector Server versions 5.7.0.0 through 5.9.4.2. Live Update was removed starting with EPP Server version 2509, and this article is retained for administrators still operating a 5.x legacy appliance.

Explains how to enable the Monitor webmail setting in Netwrix Endpoint Protector to scan the subject and body of web-based email messages and describes behavior, considerations, and limitations.

Explains how to format, deploy, and verify dictionary files used by Netwrix Password Policy Enforcer password rules, including guidance for multi-domain-controller environments.

Use this article to verify whether the Endpoint Protector network extension is enabled. You can check the status via the command line or the Endpoint Protector Console.

Explains why video recordings may not open from the When field in User Activity reports and how SQL Server Reporting Services (SSRS) settings can affect hyperlink rendering for video links.

When ISAPI Extensions and CGI Restrictions are not installed or configured correctly, Netwrix Password Reset Webpage is downloading APR.dll when attempting to load any page.

This article explains the purpose of cryptographic hashes and how to verify the integrity and authenticity of files downloaded from Endpoint Protector.

This article explains what the color indicators mean in the Endpoint Protector Server and Client. It maps each color to the corresponding device right or status so you can interpret device states at a glance.

Recommended services, processes, paths, and log locations to monitor with application performance monitoring (APM) tools for Netwrix Change Tracker's Gen7 Hub server and agents.

This article explains what a "File Read-Write" event is on the Endpoint Protector Server and provides instructions for setting up alerts and tracking existing alerts.

Lists all Windows services installed by Netwrix Activity Monitor, including display names, internal service names, and what each service does.

This article explains how to whitelist or exclude Endpoint Protector (EPP) processes in CrowdStrike to ensure proper functionality without interference from security policies.

Use these steps to whitelist authentication servers in Netwrix Endpoint Protector so authentication succeeds when Deep Packet Inspection (DPI) is enabled.

Explains why you are receiving File Access ("fileaccessed") events in Netwrix Change Tracker, what they indicate, and how to enable or disable them via policy templates.

Explains why various Linux system users (for example, root, 65534, lightdm) appear in the Endpoint Protector user interface and how the client determines the active user.

This article explains why an iPhone may remain blocked by Endpoint Protector despite having Allow Access rights and provides guidance on how to resolve the issue.

This article explains why the eDiscovery Scanning Status progress bar may drop to a lower percentage during a scan and the factors affecting its recovery time.

This article explains why Deep Packet Inspection (DPI) does not inspect content when VPN add-ons are installed on browsers and outlines the implications for endpoint data loss prevention.

This article explains why Endpoint Protector detects cameras as Digital Cameras on some computers and as Windows Portable Devices (MTP) on others.

Explains why Netwrix Endpoint Protector detects printers with internal storage as USB storage devices and how device type information is reported by the operating system.

This article explains why the serial number for an iPhone may not be correctly identified and the implications of Apple's security limitations on device identification.

Explains how Netwrix Endpoint Protector identifies smartphones and why a single phone may be detected as multiple device types depending on manufacturer and configuration.

Explains that Content Aware Protection does not block files included in the Allowed File allowlist in Netwrix Endpoint Protector and shows where to configure and assign the allowlist.