You are not receiving scheduled reports from Active Directory, Group Policy, Exchange Change Reporter and see one of the following symptoms:
2.Session records are appearing for the days reports are missing but contain warnings in the Netwrix Management Console(%domain name%>Active DirectoryGroup PolicyExchange>Sessions node), the data collection starts when you click the Run button in the Netwrix Management Console (%domain name% > right pane> Run button) but you receive no reports either way.
This issue can be caused for several reasons, depending on the root cause (see the symptoms 1 – 3 above):
- Scheduled task (NetWrix Management Console – Active Directory Change Reporter – %domain name%) cannot start
- Product cannot send email, or email is being sent but there are issues with delivery (on the Exchange side)
- The ADCR.exe process hangs.
Depending on the root cause (see the symptoms 1 – 3 above) do the following:
1. Open Task Manager, right click the NetWrix Management Console – Active Directory Change Reporter – %domain name% scheduled task and select run. If the task fails to run, open its properties and history tab. Review the errors regarding the task launch.
If you see the event ID 101 with the details outlined below, make sure that password is valid for the service account you specified to run the data collection.
Task Scheduler failed to start “NetWrix Management Console – Active Directory Change Reporter – %domain name%” task for user “domain nameaccount name”. Additional Data: Error Value: 2147943726.
Regarding the other errors you may see in the task history tab and please refer to the following Microsoft KB articles:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa383604(v=vs.85).aspx (NOTE: for this article you may need to convert the error codes from decimal to hexadecimal, for that you can use standard Windows Calculator > Programmer view )
2. Open NetWrix Management Console > %domain name% > Active Directory Change Reporter > Go to the right pane, select specified recipient and click edit, then click verify. After that, use one of the following approaches (depending on the particular case):
2.1 Email verification test has been failed.
Pay attention at the received error message (the error code and message are being taken from Exchange server), you may refer to the following Microsoft resource to troubleshot the error you received: http://technet.microsoft.com/en-us/exchange/ff396001.aspx
2.2 Email verification test has been passed but a test email has not been delivered to the recipient.
You can use the Exchange message tracking feature to determine what happens to the emails the product sends. For details please refer to the following Microsoft article: http://technet.microsoft.com/en-us/library/aa997984(v=exchg.141).aspx
2.3 Another reason could be the size of the email the product sends, make sure your Exchange server is configured to allow messages with the size of 20 mb to be sent, for more details please refer to the following Microsoft kb article: http://technet.microsoft.com/en-us/library/bb124345(v=exchg.141).aspx
2.4 If you are using a distribution group to deliver product reports to recipients please refer to the following KB article: http://www.netwrix.com/kb/1646
3. The ADCR.exe process hanging could be caused for different reasons, such as corrupted Security event log on one of the managed domain controllers, connectivity issues and some others. If your symptoms indicate that the ADCR.exe process is hanging (see the symptom 3 above) please gather diagnostic information listed below and contact Netwrix technical support:
3.1 Enable diagnostic logging
- Open registry editor and navigate to the HKEY_LOCAL_MACHINESOFTWAREWow6432NodeNetWrixAD Change Reporter registry hive
- Right click the TraceLevel registry key and set its value to 31 (decimal)
3.2 Reproduce the issue
- Open Task Manager, select ADCR.exe process and click End process button, make sure the process has been terminated
- Open Netwrix Management console and run the data collection
- Wait until the issue has been reproduced (wait at least 18 hours to confirm that report has not been delivered and symptoms are indicative that ADCR.exe is hanging)
3.3 Open support ticket on the Netwrix support portal (http://www.netwrix.com/support.html), describe your issues and upload diagnostic logs (you enabled on the step 3.1 above ): the entire contents of the Tracing subfolder from the Active Directory Change Reporter installation directory.