Netwrix Auditor System Health log – Event IDs 1267-1273

SharePoint
9.0-9.7
9.8
https://kb.netwrix.com/2257
Copy Article URL Copied

Netwrix Auditor System Health log contains the following Event IDs: 1267 – 1273

Refer to the table below for possible reasons and solutions:

Event ID Event Description Error/Cause Solution
1267 Unable to report changes to SharePoint farm <ID> correctly, as the current, previous, or both snapshots are partially invalid.
  • Access to this Web site has been blocked.
  • Access is denied (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).
  • Some or all identity references could not be translated.
  • The previous data collection completed with an error.
Do one of the following depending on the error:

  • Navigate to SharePoint Central Administration > Application Management > Configure quotas and locks > “target site collection” and change its status to “Not locked”. Alternatively, you can unlock your site using SharePoint Management Shell.
  • Navigate to SharePoint Central Administration > Web Applications > “target web application” > User Permissions and set them to “Open Items”.
  • This error is most likely due to the fact that the account under which the SharePoint service or the SharePoint WebApplication Pool is running has been removed from the AD domain but left in the service accounts portion of SharePoint. Remove this account from SharePoint service accounts, or join it back to the domain.
  • If none of the errors associated with these Event IDs were logged, do the following:
  • Navigate to Monitoring plans > “Monitoring Plan name” > Edit > Update
  • If this does not resolve the issue, contact Netwrix Technical Support
1268 Unable to report changes to web application <ID> correctly as the current, previous, or both snapshots are partially invalid.
1269 Unable to report changes to site collection <ID> correctly as the current, previous, or both snapshots are partially invalid.
1270 Unable to report changes to feature <ID> correctly as the current, previous, or both snapshots are partially invalid.
1271 Unable to report changes to solution <ID> correctly as the current, previous, or both snapshots are partially invalid.
1272 Unable to report changes to permission policy <ID> correctly as the current, previous, or both snapshots are partially invalid.
1273 Unable to report changes to server <ID> correctly as the current, previous, or both snapshots are partially invalid.

 

To change site status to “Unlock” using SharePoint Management Shell, do the following:

  1. Make sure that your account complies with the requirements mentioned in the Microsoft technical article.
  2. In your SharePoint server, navigate to Start > Microsoft SharePoint Products “version” SharePoint Management Shell.
  3. Execute the following command:  Set-SPSite -Identity “SiteCollection” -LockState “State”

Where:
“SiteCollection” is the URL of the site collection that you want to track or unlock.
“State” is one of the following values:

  • Unlock to unlock the site collection and make it available to users.
  • NoAdditions to prevent users from adding new content to the site collection. Updates and deletions are still allowed.
  • ReadOnly to prevent users from adding, updating, or deleting content.
  • NoAccess to prevent users from accessing the site collection and its content. Users who attempt to access the site receive an error.
Go Up