Netwrix Auditor EventLog – eventID 1037/1038

SharePoint
6.5 and older
7.0-8.5
9.0-9.7
9.8
https://kb.netwrix.com/148
Copy Article URL Copied

If event id 1037/1038 is logged in Netwrix Auditor System Health event log, refer to the table for possible reasons and solutions:

Error

Unable to collect content/security events from site collection: Attempted to perform an unauthorized operation. The product failed to collect content/security changes from the audited site collection as its status is lower than “Adding content prevented”.

Cause

The Farm account or the Service account of the web application pool hosting the audited site collection, has been modified and has not been granted the “Logon as a batch job” permission on the server that hosts SharePoint Central Administration. Navigate to SharePoint Central Administration > Application Management > Configure quotas and locks > Change its status to “Not locked”.

Solution

If this does not resolve the issue, contact your SharePoint administrator. Unable to collect content/security events from site collection : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)). The product failed to collect content/security changes from the audited site collection as there are insufficient permissions of the web application hosting the target site collection. Navigate to SharePoint Central Administration > Web Applications > User Permissions and verify the security settings of this web application. The minimum required permissions are “Manage Web Site”. Unable to collect content/security events from site collection: Access to this Web site has been blocked. The product failed to collect content/security changes from the audited site collection, as its status is “Locked – No Access”. Navigate to SharePoint Central Administration > Application Management > Configure quotas and locks > Change its status to “Not locked”.

 

Go Up