Netwrix Auditor System Health Log - Event ID 1251 - 1254, 1256 - 1258 OR 1051 - 1054, 1056 - 1058

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event IDs and provides resolution.
Email It to Me Print this Page
Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1251, 1252, 1253, 1254, 1256, 1257,1258
Netwrix Auditor 8.5 and below: 1051, 1052, 1053, 1054, 1056, 1057, 1058 

"Netwrix Auditor has been unable to add  an object to the auditing scope due one of the following errors on your SharePoint server".  
Refer to the table below for possible reasons and solutions:
12511051 - Unable to find web application <URL> .
12521052 - Unable to get a list of web applications from the audited SharePoint farm .
-  1253 / 1053 -  Unable to find the parent web application for site collection <URL>.
-  1254 / 1054 - Unable to find the parent web application <URL> .
-  1256 /1056 - Unable to find site collection <URL> due to the following error.
-  1257 / 1057 - Unable to get a list of web applications from the audited SharePoint farm.
-  1258 / 1058 - Unable to find the Central Administration web application. 
Access to this Web site has been blocked.Navigate to SharePoint Central Administration --> Application Management --> Configure quotas and locks --> <target site collection> and change its "No access" lock status to a more permissive one. Alternatively, you can unlock your site using SharePoint Management Shell
Access is denied (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).


Navigate to SharePoint Central Administration --> Web Applications --> <target web application> --> User Permissions and set them to "Manage web Site".
Some or all identity references could not be translated.


This error is most likely due to the fact that the account under which the SharePoint service or the SharePoint WebApplication Pool is running has been removed from the AD domain but left in the service accounts portion of SharePoint. If this is the case, contact your SharePoint administrator.
Wrong URL was added to the auditing scope or the object available by this link is invalid.If the error contains URL, make sure that this URL is valid and the object can be accessed by this URL. Contact your SharePoint administrator.
To change site status to "Unlock" using SharePoint Management Shell, do the following:
  1. Make sure that your account complies with the requirements mentioned in the Microsoft technical article.
  2. In your SharePoint server, navigate to Start --> Microsoft SharePoint Products <version> SharePoint Management Shell.
  3. Execute the following command:  Set-SPSite -Identity "<SiteCollection>" -LockState "<State>"
<SiteCollection> is the URL of the site collection that you want to track or unlock.
<State> is one of the following values:
  • Unlock to unlock the site collection and make it available to users.

  • NoAdditions to prevent users from adding new content to the site collection. Updates and deletions are still allowed.

  • ReadOnly to prevent users from adding, updating, or deleting content.

  • NoAccess to prevent users from accessing the site collection and its content. Users who attempt to access the site receive an error.

Was this information helpful?