Netwrix Auditor System Health log – Event ID 1251 – 1254, 1256 – 1258

Copy Article URL Copied

Netwrix Auditor System Health log contains the following Event ID: 1251, 1252, 1253, 1254, 1256, 1257,1258

“Netwrix Auditor has been unable to add  an object to the auditing scope due one of the following errors on your SharePoint server”.
Refer to the table below for possible reasons and solutions:

Error Cause Solution
– 1251 – Unable to find web application <URL> .
– 1252 – Unable to get a list of web applications from the audited SharePoint farm .
– 1253 –  Unable to find the parent web application for site collection <URL>.
– 1254  – Unable to find the parent web application <URL> .
– 1256 – Unable to find site collection <URL> due to the following error.
– 1257 – Unable to get a list of web applications from the audited SharePoint farm.
– 1258 – Unable to find the Central Administration web application.
Access to this Web site has been blocked. Navigate to SharePoint Central Administration > Application Management > Configure quotas and locks > “target site collection” and change its “No access” lock status to a more permissive one. Alternatively, you can unlock your site using SharePoint Management Shell.
Access is denied (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)). Navigate to SharePoint Central Administration > Web Applications > “target web application” > User Permissions and set them to “Manage web Site”.
Some or all identity references could not be translated. This error is most likely due to the fact that the account under which the SharePoint service or the SharePoint WebApplication Pool is running has been removed from the AD domain but left in the service accounts portion of SharePoint. If this is the case, contact your SharePoint administrator.
Wrong URL was added to the auditing scope or the object available by this link is invalid. If the error contains URL, make sure that this URL is valid and the object can be accessed by this URL. Contact your SharePoint administrator.

To change site status to “Unlock” using SharePoint Management Shell, do the following:

  1. Make sure that your account complies with the requirements mentioned in the Microsoft technical article.
  2. In your SharePoint server, navigate to Start > Microsoft SharePoint Products “version” SharePoint Management Shell.
  3. Execute the following command:  Set-SPSite -Identity “SiteCollection” -LockState “State”

“SiteCollection” is the URL of the site collection that you want to track or unlock.
“State” is one of the following values:

  • Unlock to unlock the site collection and make it available to users.
  • NoAdditions to prevent users from adding new content to the site collection. Updates and deletions are still allowed.
  • ReadOnly to prevent users from adding, updating, or deleting content.
  • NoAccess to prevent users from accessing the site collection and its content. Users who attempt to access the site receive an error.
Go Up