This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the EventIDs and provides resolution.
|Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventIDs:
Netwrix Auditor 9.0 and above: Event IDs 1267 - 1273
Netwrix Auditor 8.5 and below: Event IDs 1067 - 1073
Refer to the table below for possible reasons and solutions:
To change site status to "Unlock" using SharePoint Management Shell, do the following:
|1267 / 1067||Unable to report changes to SharePoint farm <ID> correctly, as the current, previous, or both snapshots are partially invalid.||
- Access to this Web site has been blocked.
- Access is denied (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).
- Some or all identity references could not be translated.
- The previous data collection completed with an error.
|Do one of the following depending on the error:
- Navigate to SharePoint Central Administration --> Application Management --> Configure quotas and locks --> <target site collection> and change its status to "Not locked". Alternatively, you can unlock your site using SharePoint Management Shell.
- Navigate to SharePoint Central Administration --> Web Applications --> <target web application> --> User Permissions and set them to "Open Items".
- This error is most likely due to the fact that the account under which trhe SharePoint service or the SharePoint WebApplication Pool is running has been removed from the AD domain but left in the service accounts portion of SharePoint. Remove this account from SharePoint service accounts, or join it back to the domain.
- If none of the errors associated with these EventIDs were logged, do the following, depending on your Netwrix Auditor version:
- Netwrix Auditor 9.0 and above: navigate to Monitoring plans --> <Your Monitoring Plan name> --> Edit --> Update
- Netwrix Auditor 8.5 and below: navigate to Managed Objects --> <Managed_Object_name> --> SharePoint and click Run.
- If this does not resolve the issue, contact Netwrix Technical Support
|1268 / 1068||Unable to report changes to web application <ID> correctly as the current, previous, or both snapshots are partially invalid.|
|1269 / 1069||Unable to report changes to site collection <ID> correctly as the current, previous, or both snapshots are partially invalid.|
|1270 / 1070||Unable to report changes to feature <ID> correctly as the current, previous, or both snapshots are partially invalid.|
|1271 / 1071||Unable to report changes to solution <ID> correctly as the current, previous, or both snapshots are partially invalid.|
|1272 / 1072||Unable to report changes to permission policy <ID> correctly as the current, previous, or both snapshots are partially invalid.|
|1273 / 1073||Unable to report changes to server <ID> correctly as the current, previous, or both snapshots are partially invalid.|
- Make sure that your account complies with the requirements mentioned in the Microsoft technical article.
- In your SharePoint server, navigate to Start --> Microsoft SharePoint Products <version> SharePoint Management Shell.
- Execute the following command: Set-SPSite -Identity "<SiteCollection>" -LockState "<State>"
is the URL of the site collection that you want to track or unlock.<State>
is one of the following values:
Unlock to unlock the site collection and make it available to users.
NoAdditions to prevent users from adding new content to the site collection. Updates and deletions are still allowed.
ReadOnly to prevent users from adding, updating, or deleting content.
NoAccess to prevent users from accessing the site collection and its content. Users who attempt to access the site receive an error.