Netwrix Auditor Event log - Event ID 1074 / 1274

This article applies to Netwrix Auditor 6.5. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1274
Netwrix Auditor 8.5 and below: 1074


The following error occurred when trying to launch the component responsible for collecting AD group membership, because the product is unable to detect the forest where the audited SharePoint farm is located.
Cause
  1. Netwrix Auditor was unable to detect the forest where your SharePoint farm is hosted. Probably, there is no network connection to your SharePoint farm. See Resolution 1.
  2. This can be cause by the following errors:
  • EventID 12003 / 1003: "The service <service name> has failed." 
  • EventID 1204 / 1004: "Unable to establish connection to the remote WebService."
  • EventID 1205 / 1005: "The following unexpected error has occurred: <error>."
See Resolution 2.
  1. In the domain where our SharePoint farm resides the domain controller holding the global catalog was unreachable while the data collection was in progress. See Resolution 3.
Resolution
  1. Make sure that your SharePoint Central Administration site is reachable. To test it, open the SharePoint Central Administration site in any browser on the computer where Netwrix Auditor is installed.
  2. Refer to the following Knowledge Base articles for possible solutions:
  1. Make sure that the domain controller that stores the global catalog of the domain where your SharePoint farm resides is now reachable. For example, ping it.
Was this information helpful?