Netwrix Auditor System Health Log - Event ID 1241 / 1041

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following Event ID:
Netwrix Auditor 9.0 and above: 1241
Netwrix Auditor 8.5 and below: 1041

"Audit settings for security events in site collection <ID> are not configured properly. As a result, some security events may be lost".
Cause The Editing users and permissions audit is disabled on the site collection.
Resolution Do one of the following:
  • In Netwrix Auditor 9.0 and above, navigate to Monitoring Plans -> Your Monitoring Plan which contains SharePoint Data Source -> Select the Data Source and click Edit Data Source. Then select Adjust audit settings automatically.
  • In Netwrix Auditor 8.5 and below, open Netwrix Auditor Administrator Console, navigate to Managed Objects --> your_SharePoint_Managed_Object  --> SharePoint and click Configure Options. In the Options dialog, select Adjust audit settings automatically.
On your site collection that must be included in the audited scope, navigate to Site settings --> Site collection audit settings-->  Specify the events to audit and select Editing users and permissions.
Was this information helpful?