Skip to content

Commit 6ad9b23

Browse files
hilram7hilram7
authored
Merge pull request #322 from netwrix/NAA-KB-NEW-clean
Add three new Access Analyzer KB articles and update existing KB
2 parents 21e3bdf + ec287c4 commit 6ad9b23

4 files changed

+283
-27
lines changed

‎docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
title: "ExchangePS Error: The WinRM Shell Client Cannot Process the Request"
3+
sidebar_label: "ExchangePS Error: The WinRM Shell Client Cannot Process the Request"
4+
description: "Resolves the 'WinRM Shell client cannot process the request' error in ExchangePS data collector jobs by updating the PackageManagement and ExchangeOnlineManagement PowerShell modules to supported versions."
5+
keywords:
6+
- WinRM
7+
- ExchangePS
8+
- PowerShell
9+
- New-ExoPSSession
10+
- ExchangeOnlineManagement
11+
- PackageManagement
12+
- Office 365
13+
- remote session
14+
- module update
15+
- data collector
16+
- Netwrix Access Analyzer
17+
- Netwrix Enterprise Auditor
18+
products: [enterprise_auditor, access_analyzer]
19+
knowledge_article_id: kA0Qk0000003Fc1KAE
20+
---
21+
22+
## Related Queries
23+
24+
- "ExchangePS shell handle is not valid."
25+
- "New-ExoPSSession fails with WinRM Shell client error."
26+
- "ExchangeOnlineManagement 2.0.5 error with StealthAUDIT job."
27+
- "Stealthbits Exchange data collector fails to connect."
28+
29+
## Symptom
30+
31+
Jobs that use the ExchangePS data collector fail with the following error:
32+
33+
```text
34+
PowerShell error: System.Exception: New-ExoPSSession : Processing data from remote server outlook.office365.com failed with the following error message: The WinRM Shell client cannot process the request. The shell handle passed to the WSMan Shell function is not valid. The shell handle is valid only when WSManCreateShell function completes successfully.
35+
```
36+
37+
## Cause
38+
39+
This issue occurs when one or both of the following PowerShell modules are outdated or incompatible:
40+
41+
- `PackageManagement` module version is earlier than `1.0.0.1`
42+
- `ExchangeOnlineManagement` module version is `2.0.5` or earlier
43+
44+
These versions are known to cause instability with remote sessions using `New-ExoPSSession`.
45+
46+
## Resolution
47+
48+
### Step 1: Verify Installed Module Versions
49+
50+
Open a PowerShell session and run:
51+
52+
```powershell
53+
Get-Module -ListAvailable PackageManagement
54+
Get-Module -ListAvailable ExchangeOnlineManagement
55+
```
56+
57+
### Step 2: Update Modules Using PowerShell (Preferred Method)
58+
59+
- Update `PackageManagement` module:
60+
```powershell
61+
Install-Module PackageManagement -Force -Scope AllUsers
62+
```
63+
64+
- Update `ExchangeOnlineManagement` module:
65+
```powershell
66+
Install-Module ExchangeOnlineManagement -Force -Scope AllUsers
67+
```
68+
69+
> **IMPORTANT:**
70+
> Close and reopen all PowerShell sessions after updating modules.
71+
72+
### Step 3: Manual Update (If Unable to Install via PowerShell)
73+
74+
If the environment prevents direct downloads from PowerShell, update the modules manually.
75+
76+
#### Download the `.nupkg` Files
77+
78+
1. Visit the following URLs:
79+
- [PackageManagement 1.4.8.1](https://www.powershellgallery.com/packages/PackageManagement/1.4.8.1)
80+
- [ExchangeOnlineManagement 3.9.1-Preview1](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.9.1-Preview1)
81+
82+
2. Download the `.nupkg` file for each required version.
83+
84+
#### Convert `.nupkg` to ZIP and Extract
85+
86+
1. Rename the downloaded `.nupkg` file to `.zip`
87+
Example: `PackageManagement.1.4.8.1.zip`
88+
2. Unblock the ZIP file using one of the following methods:
89+
- In File Explorer, right-click **Properties** > **Unblock**.
90+
- Or run:
91+
```powershell
92+
Unblock-File .\PackageManagement.1.4.8.1.zip
93+
```
94+
3. Extract the contents of each ZIP file.
95+
96+
#### Rename the Extracted Folder
97+
98+
- Rename `PackageManagement.1.4.8.1` to `1.4.8.1`
99+
- Rename `ExchangeOnlineManagement.3.4.0` to `3.4.0` (or the version you downloaded)
100+
101+
#### Move to PowerShell Modules Directory
102+
103+
Place the renamed folders in the correct directories:
104+
105+
- For PackageManagement:
106+
`C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.4.8.1`
107+
- For ExchangeOnlineManagement:
108+
`C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.4.0`
109+
110+
### Step 4: Confirm Module Versions
111+
112+
Re-run the version checks:
113+
114+
```powershell
115+
Get-Module -ListAvailable PackageManagement
116+
Get-Module -ListAvailable ExchangeOnlineManagement
117+
```
118+
119+
Ensure that:
120+
121+
- `PackageManagement` is version **1.4.8.1** or newer
122+
- `ExchangeOnlineManagement` is version **2.0.6** or newer
123+
124+
> **IMPORTANT:**
125+
> Rerun jobs that use the ExchangePS data collector to confirm that the error message no longer appears.
126+
127+
---

‎docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
title: "ExchangePS Error: Cannot Find a Variable With the Name 'EnableSearchOnlySession'"
3+
sidebar_label: "ExchangePS Error: Cannot Find a Variable With the Name 'EnableSearchOnlySession'"
4+
description: "Resolves the 'Cannot find a variable with the name EnableSearchOnlySession' error in ExchangePS data collector jobs by configuring an explicit connection profile with valid Exchange credentials."
5+
keywords:
6+
- WinRM
7+
- ExchangePS
8+
- EnableSearchOnlySession
9+
- PowerShell
10+
- Exchange
11+
- connection profile
12+
- EX_MBRights
13+
- EX_SendAs
14+
- data collector
15+
- Netwrix Access Analyzer
16+
- Netwrix Enterprise Auditor
17+
- Exchange credentials
18+
products: [enterprise_auditor, access_analyzer]
19+
knowledge_article_id: kA0Qk00000039TNKAY
20+
---
21+
22+
## Related Queries
23+
24+
- "Receiving Get-Variable 'EnableSearchOnlySession' error on EX_MBRights job."
25+
- "EX_SendAs job failed to inherit credentials."
26+
- "Cannot find a variable with the name 'EnableSearchOnlySession'."
27+
28+
## Symptom
29+
30+
When running Exchange jobs using the ExchangePS data collector, the following error appears:
31+
32+
```text
33+
Get-Variable 'EnableSearchOnlySession' error: Cannot find a variable with the name 'EnableSearchOnlySession'.
34+
```
35+
36+
## Cause
37+
38+
This issue occurs when the ExchangePS data collector fails to inherit the correct session credentials.
39+
Without proper credentials, the session does not initialize the expected variables, including `EnableSearchOnlySession`.
40+
41+
## Resolution
42+
43+
To resolve the issue, configure the job to use an explicit connection profile.
44+
This ensures the session uses the appropriate credentials, allowing the necessary variables to load correctly.
45+
46+
1. Right-click the affected job.
47+
2. Select **Properties**.
48+
3. Go to the **Connection** tab.
49+
4. Choose the bottom radio button to specify a custom connection profile.
50+
5. Select the connection profile that contains valid Exchange credentials.
51+
52+
> **NOTE:**
53+
> Navigate to **Settings > Connection** to verify which credentials are valid for Exchange.
54+
55+
6. Click **OK** to save the changes.
56+
57+
---

‎docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
title: "SEEK Bulk Import Warning: DLPEX Database Does Not Exist"
3+
sidebar_label: "SEEK Bulk Import Warning: DLPEX Database Does Not Exist"
4+
description: "Explains why the warning 'DLPEX database does not exist' appears during SEEK Bulk Import and how to resolve it by verifying SEEK Scan completion and DLPEX database availability."
5+
keywords:
6+
- SEEK
7+
- DLPEX
8+
- bulk import
9+
- T2 database
10+
- data classification
11+
- sensitive data
12+
- SEEK Scan
13+
- import warning
14+
- Netwrix Access Analyzer
15+
- Netwrix Enterprise Auditor
16+
- scan failure
17+
- missing database
18+
products: [enterprise_auditor, access_analyzer]
19+
knowledge_article_id: kA0Qk0000003BdFKAU
20+
---
21+
22+
## Related Queries
23+
24+
- "SEEK Bulk Import error DLPEX database does not exist."
25+
- "No sensitive data to import SEEK."
26+
- "SEEK import warning T2 not found."
27+
- "SEEK or SDD scan ran, but import fails."
28+
29+
## Symptom
30+
31+
When running a SEEK Bulk Import, the following warning is displayed:
32+
33+
```text
34+
WARNING | DLPEX database does not exist, there is no data to import.
35+
```
36+
37+
Despite the warning, the import process completes without any imported data.
38+
39+
## Cause
40+
41+
This warning indicates that the system attempted to import sensitive data (T2) from a host that does not have the required DLPEX database.
42+
This can occur due to one of the following reasons:
43+
44+
- **Unscanned hosts in the import list:** One or more hosts included in the bulk import were not scanned using SEEK Scan, and therefore, no DLPEX (T2) database was created.
45+
- **Scan failures:** The host experienced a catastrophic error during the SEEK Scan, which prevented the creation of the sensitive data (T2) database.
46+
47+
> **NOTE:**
48+
> If the import runs and simply finds no new data (but the database exists), no warning is shown and the import completes successfully.
49+
> The warning only appears if the expected DLPEX database is missing entirely.
50+
51+
## Resolution
52+
53+
To resolve this warning, follow these steps:
54+
55+
1. **Review the host list**
56+
- Confirm that all hosts listed in the SEEK Bulk Import are being scanned via SEEK Scan.
57+
- Remove any hosts from the list that are not currently scanned.
58+
59+
2. **Check scan results**
60+
- Investigate SEEK Scan logs for any failed scans.
61+
- Look for errors indicating that the DLPEX or T2 database could not be created.
62+
63+
3. **Rerun the scan**
64+
- Rerun the SEEK Scan on the affected hosts to generate the T2 database.
65+
66+
4. **Retry the bulk import**
67+
- Once scans have completed successfully and the DLPEX databases exist, rerun the SEEK Bulk Import.
68+
69+
---

‎docs/kb/accessanalyzer/error-invalid-local-storage-version.md‎

Lines changed: 30 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,57 @@
11
---
2-
description: >-
3-
An Activity Auditing (SPAC) scan fails after upgrading Netwrix Access Analyzer
4-
with an Invalid local SPAA storage version error; follow the steps to update
5-
the SPAA database schema.
2+
title: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0"
3+
sidebar_label: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0"
4+
description: "Resolves the 'Invalid local SPAA storage version' error that occurs when running a SPAC System Scan in Netwrix Access Analyzer by updating the SPAA database schema through the appropriate System Scan and Bulk Import jobs."
65
keywords:
76
- SPAA
87
- SPAC
9-
- Invalid local storage version
10-
- SPSEEK
11-
- SPAA_BulkImport
8+
- System Scan
9+
- Bulk Import
10+
- InvalidStorageVersionException
11+
- SharePoint
12+
- schema update
1213
- Netwrix Access Analyzer
13-
- database schema
14-
- SystemScans
14+
- Netwrix Enterprise Auditor
15+
- database version
16+
- upgrade issue
17+
- SPSEEK
1518
products:
16-
- access-analyzer
17-
sidebar_label: "Error: Invalid Local Storage Version"
18-
tags: []
19-
title: 'Error: Invalid Local Storage Version'
19+
- enterprise_auditor
2020
knowledge_article_id: kA0Qk0000001RUPKA2
2121
---
2222

23-
# Error: Invalid Local Storage Version
23+
# Error: Invalid Local SPAA Storage Version When Running SPAC System Scan
2424

2525
## Symptom
2626

27-
After the recent Netwrix Access Analyzer upgrade (`11.6.0.69`), an Activity Auditing (SPAC) scan populates the following error:
27+
When attempting to run a **SPAC System Scan** in **Netwrix Access Analyzer** (formerly Enterprise Auditor) after upgrading, the following error occurs:
2828

2929
```text
3030
Stealthbits.StealthAUDIT.DataCollectors.SPAA.Storage.InvalidStorageVersionException:
31-
Invalid local SPAA storage version. Expected %x& but found %y%.
31+
Invalid local SPAA storage version. Expected 11603 but found 0.
3232
```
3333

3434
## Cause
3535

36-
The SPAA database schema is outdated and requires an update.
36+
The SPAA database schema is outdated and requires an update. This error occurs when a SPAC System Scan* is run *before* a SPAA System Scan or SPSEEK System Scan has been executed.
3737

3838
## Resolution
3939

4040
Perform the following steps to update the database schema:
4141

42-
1. Run either the **1-SPSEEK_SystemScans** or **2-SPAA_SystemScans** job at `level 0`. Refer to the following articles for additional information:
43-
- https://docs.netwrix.com/docs/auditor/10_8
44-
- https://docs.netwrix.com/docs/auditor/10_8
45-
2. Depending on the previously selected job, run either the **4-SPSEEK_BulkImport** or **5-SPAA_BulkImport** job to update the schema.
46-
3. Run the **3-SPAC_SystemScans** job to verify that the issue is resolved.
42+
1. **Run a System Scan job at level 0**
43+
- Run either the **1-SPSEEK_SystemScans** or **2-SPAA_SystemScans** job.
44+
- Refer to the following documentation for details:
45+
- [1-SPSEEK_SystemScans Job ⸱ Netwrix Docs 🡥](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/sharepoint/collection/spseek_systemscans)
46+
- [2-SPAA_SystemScans Job ⸱ Netwrix Docs 🡥](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/sharepoint/collection/spaa_systemscans)
47+
48+
2. **Run a Bulk Import job to update the schema**
49+
- Depending on the job used in step 1, run either the **4-SPSEEK_BulkImport** or **5-SPAA_BulkImport** job.
4750

48-
## Related Articles
51+
3. **Verify the issue is resolved**
52+
- Run the **3-SPAC_SystemScans** job to confirm that the error no longer appears.
4953

50-
- 0.Collection Job Group — 1-SPSEEK_SystemScans Job · v11.6
51-
https://docs.netwrix.com/docs/auditor/10_8
54+
## Related Links
5255

53-
- 0.Collection Job Group — 2-SPAA_SystemScans Job · v11.6
54-
https://docs.netwrix.com/docs/auditor/10_8
56+
- [1-SPSEEK_SystemScans Job](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/sharepoint/collection/spseek_systemscans)
57+
- [2-SPAA_SystemScans Job](https://docs.netwrix.com/docs/accessanalyzer/12_0/solutions/sharepoint/collection/spaa_systemscans)

0 commit comments

Comments
 (0)