Netwrix Auditor System Health Log - EventID 1207 / 1007

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the EventID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1207 - "
Automatic Netwrix Auditor for SharePoint Core Service deployment failed".
Netwrix Auditor 8.5 and below: 1007 - 
"Wrong version of Netwrix Auditor Agent for SharePoint".

Cause The Netwrix Auditor for SharePoint Core Service (Agent for Netwrix Auditor 8.5 and below) version is different from the product version.
Resolution When you upgrade Netwrix Auditor to a newer version, you must manually uninstall the agent from the computer that hosts SharePoint Central Administration. After that, the product will automatically install the latest version of the agent (if the automatic agent deployment mode is selected on Managed Object creation).
If you want to install the agent manually, refer to the following Kowledge Base article for instructions: How to manually install Netwrix Auditor Agent for SharePoint?
The agent installation package can be found in the following directory depending on your current Netwrix Auditor version:
  • For Netwrix Auditor 7.0 and above, navigate to​ %Netwrix Auditor installation folder%\SharePoint Auditing\SharePointPackage/SpaPackage_<version>.msi
  • For Netwrix Auditor 6.5 and below, navigate to​ %Netwrix Auditor installation folder%/SharePointPackage/SpaPackage_<version>.msi
Was this information helpful?