Depending on Netwrix Auditor version, Netwrix Auditor System Health event log contains the following Event ID: 1074
The following error occurred when trying to launch the component responsible for collecting AD group membership, because the product is unable to detect the forest where the audited SharePoint farm is located.
- Netwrix Auditor was unable to detect the forest where your SharePoint farm is hosted. Probably, there is no network connection to your SharePoint farm. See Resolution 1.
- This can be cause by the following errors:
- EventID 1003: “The service <service name> has failed.”
- EventID 1004: “Unable to establish connection to the remote WebService.”
- EventID 1005: “The following unexpected error has occurred: <error>.”
- In the domain where our SharePoint farm resides the domain controller holding the global catalog was unreachable while the data collection was in progress. See Resolution 3.
- Make sure that your SharePoint Central Administration site is reachable. To test it, open the SharePoint Central Administration site in any browser on the computer where Netwrix Auditor is installed.
- Refer to the following Knowledge Base articles for possible solutions:
- EventID 1003 – https://kb.netwrix.com/1120
- EventID 1004 – https://kb.netwrix.com/1130
- EventID 1005 – https://kb.netwrix.com/1129
- Make sure that the domain controller that stores the global catalog of the domain where your SharePoint farm resides is now reachable. For example, ping it.