This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event ID and provides resolution.
||Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following Event ID:
Netwrix Auditor 9.0 and above: 1241
Netwrix Auditor 8.5 and below: 1041
"Audit settings for security events in site collection <ID> are not configured properly. As a result, some security events may be lost".
||The Editing users and permissions audit is disabled on the site collection.
||Do one of the following:
On your site collection that must be included in the audited scope, navigate to Site settings --> Site collection audit settings--> Specify the events to audit and select Editing users and permissions.
- In Netwrix Auditor 9.0 and above, navigate to Monitoring Plans -> Your Monitoring Plan which contains SharePoint Data Source -> Select the Data Source and click Edit Data Source. Then select Adjust audit settings automatically.
- In Netwrix Auditor 8.5 and below, open Netwrix Auditor Administrator Console, navigate to Managed Objects --> your_SharePoint_Managed_Object --> SharePoint and click Configure Options. In the Options dialog, select Adjust audit settings automatically.