Skip to content

Commit 78d52ed

Browse files
hilram7hilram7
committed
docs(kb): add 4 new Access Analyzer KB articles with proper .md extensions
1 parent 5cd71cb commit 78d52ed

4 files changed

+253
-0
lines changed

‎docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
title: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0"
3+
sidebar_label: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0"
4+
description: "Resolve the 'Invalid Local SPAA Storage Version' error in Netwrix Access Analyzer by running the required SPAA or SPSEEK System Scans before executing a SPAC System Scan."
5+
keywords: [SPAA, SPAC, SPSEEK, InvalidStorageVersionException, Netwrix, Access Analyzer, system scan, storage version, error 11603]
6+
products: [access-analyzer, enterprise-auditor]
7+
knowledge_article_id: ka0Qk000000GLq5IAG
8+
---
9+
10+
## Related Queries
11+
12+
- "SPAC scan fails with storage version error."
13+
- "Error: InvalidStorageVersionException Expected 11603."
14+
15+
## Symptom
16+
17+
When attempting to run a SPAC System Scan in Netwrix Access Analyzer (formerly Enterprise Auditor), the following error occurs:
18+
19+
```text
20+
Stealthbits.StealthAUDIT.DataCollectors.SPAA.Storage.InvalidStorageVersionException: Invalid local spaa storage version. Expected 11603 but found 0.
21+
```
22+
23+
## Cause
24+
25+
This error occurs when a SPAC System Scan is run *before* a SPAA System Scan or SPSEEK System Scan has been executed.
26+
These scans are required to initialize and version the local SPAA storage.
27+
If neither scan has been completed, the system reports an invalid version of `0`.
28+
29+
## Resolution
30+
31+
To resolve the issue:
32+
33+
1. Run a **SPAA System Scan** or a **SPSEEK System Scan**
34+
2. After the scan completes successfully, run the **SPAC System Scan** again.
35+
36+
---

‎docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request.md‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
---
2+
title: "ExchangePS Error: The WinRM Shell Client Cannot Process the Request"
3+
sidebar_label: "ExchangePS Error: The WinRM Shell Client Cannot Process the Request"
4+
description: "Learn how to resolve the 'WinRM Shell client cannot process the request' error in ExchangePS data collector jobs by updating the PackageManagement and ExchangeOnlineManagement PowerShell modules."
5+
keywords: [ExchangePS, WinRM, New-ExoPSSession, PowerShell, ExchangeOnlineManagement, PackageManagement, StealthAUDIT, data collector, Office 365, remote session]
6+
products: [enterprise-auditor, access-analyzer]
7+
knowledge_article_id: ka0Qk000000GS0LIAW
8+
---
9+
10+
## Related Queries
11+
12+
- "ExchangePS shell handle is not valid."
13+
- "New-ExoPSSession fails with WinRM Shell client error."
14+
- "ExchangeOnlineManagement 2.0.5 error with StealthAUDIT job."
15+
- "Stealthbits Exchange data collector fails to connect."
16+
17+
## Symptom
18+
19+
Jobs that use the ExchangePS data collector fail with the following error:
20+
21+
```text
22+
PowerShell error: System.Exception: New-ExoPSSession : Processing data from remote server outlook.office365.com failed with the following error message: The WinRM Shell client cannot process the request. The shell handle passed to the WSMan Shell function is not valid. The shell handle is valid only when WSManCreateShell function completes successfully.
23+
```
24+
25+
## Cause
26+
27+
This issue occurs when one or both of the following PowerShell modules are outdated or incompatible:
28+
29+
- `PackageManagement` module version is earlier than `1.0.0.1`
30+
- `ExchangeOnlineManagement` module version is `2.0.5` or earlier
31+
32+
These versions are known to cause instability with remote sessions using `New-ExoPSSession`.
33+
34+
## Resolution
35+
36+
### Step 1: Verify Installed Module Versions
37+
38+
Open a PowerShell session and run:
39+
40+
```powershell
41+
Get-Module -ListAvailable PackageManagement
42+
Get-Module -ListAvailable ExchangeOnlineManagement
43+
```
44+
45+
### Step 2: Update Modules Using PowerShell (Preferred Method)
46+
47+
- Update `PackageManagement` module:
48+
```powershell
49+
Install-Module PackageManagement -Force -Scope AllUsers
50+
```
51+
52+
- Update `ExchangeOnlineManagement` module:
53+
```powershell
54+
Install-Module ExchangeOnlineManagement -Force -Scope AllUsers
55+
```
56+
57+
> **IMPORTANT:**
58+
> Close and reopen all PowerShell sessions after updating modules.
59+
60+
### Step 3: Manual Update (If Unable to Install via PowerShell)
61+
62+
If the environment prevents direct downloads from PowerShell, update the modules manually.
63+
64+
#### Download the `.nupkg` Files
65+
66+
1. Visit the following URLs:
67+
- [PackageManagement 1.4.8.1](https://www.powershellgallery.com/packages/PackageManagement/1.4.8.1)
68+
- [ExchangeOnlineManagement 3.9.1-Preview1](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.9.1-Preview1)
69+
70+
2. Download the `.nupkg` file for each required version.
71+
72+
#### Convert `.nupkg` to ZIP and Extract
73+
74+
1. Rename the downloaded `.nupkg` file to `.zip`
75+
Example: `PackageManagement.1.4.8.1.zip`
76+
2. Unblock the ZIP file using one of the following methods:
77+
- In File Explorer, right-click **Properties** > **Unblock**.
78+
- Or run:
79+
```powershell
80+
Unblock-File .\PackageManagement.1.4.8.1.zip
81+
```
82+
3. Extract the contents of each ZIP file.
83+
84+
#### Rename the Extracted Folder
85+
86+
- Rename `PackageManagement.1.4.8.1` to `1.4.8.1`
87+
- Rename `ExchangeOnlineManagement.3.4.0` to `3.4.0` (or the version you downloaded)
88+
89+
#### Move to PowerShell Modules Directory
90+
91+
Place the renamed folders in the correct directories:
92+
93+
- For PackageManagement:
94+
`C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.4.8.1`
95+
- For ExchangeOnlineManagement:
96+
`C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.4.0`
97+
98+
### Step 4: Confirm Module Versions
99+
100+
Re-run the version checks:
101+
102+
```powershell
103+
Get-Module -ListAvailable PackageManagement
104+
Get-Module -ListAvailable ExchangeOnlineManagement
105+
```
106+
107+
Ensure that:
108+
109+
- `PackageManagement` is version **1.4.8.1** or newer
110+
- `ExchangeOnlineManagement` is version **2.0.6** or newer
111+
112+
> **IMPORTANT:**
113+
> Rerun jobs that use the ExchangePS data collector to confirm that the error message no longer appears.
114+
115+
---

‎docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
title: "ExchangePS Error: Cannot Find a Variable With the Name 'EnableSearchOnlySession'"
3+
sidebar_label: "ExchangePS Error: Cannot Find a Variable With the Name 'EnableSearchOnlySession'"
4+
description: "Resolve the ExchangePS data collector error 'Cannot find a variable with the name EnableSearchOnlySession' by configuring the job to use an explicit connection profile with valid Exchange credentials."
5+
keywords: [ExchangePS, EnableSearchOnlySession, PowerShell, StealthAUDIT, EX_MBRights, EX_SendAs, data collector, connection profile, Exchange, credentials]
6+
products: [enterprise-auditor, access-analyzer]
7+
knowledge_article_id: ka0Qk000000GCtFIAW
8+
---
9+
10+
## Related Queries
11+
12+
- "Receiving Get-Variable 'EnableSearchOnlySession' error on EX_MBRights job."
13+
- "EX_SendAs job failed to inherit credentials."
14+
- "Cannot find a variable with the name 'EnableSearchOnlySession'."
15+
16+
## Symptom
17+
18+
When running Exchange jobs using the ExchangePS data collector, the following error appears:
19+
20+
```text
21+
Get-Variable 'EnableSearchOnlySession' error: Cannot find a variable with the name 'EnableSearchOnlySession'.
22+
```
23+
24+
## Cause
25+
26+
This issue occurs when the ExchangePS data collector fails to inherit the correct session credentials.
27+
Without proper credentials, the session does not initialize the expected variables, including `EnableSearchOnlySession`.
28+
29+
## Resolution
30+
31+
To resolve the issue, configure the job to use an explicit connection profile.
32+
This ensures the session uses the appropriate credentials, allowing the necessary variables to load correctly.
33+
34+
1. Right-click the affected job.
35+
2. Select **Properties**.
36+
3. Go to the **Connection** tab.
37+
4. Choose the bottom radio button to specify a custom connection profile.
38+
5. Select the connection profile that contains valid Exchange credentials.
39+
40+
> **NOTE:**
41+
> Navigate to **Settings > Connection** to verify which credentials are valid for Exchange.
42+
43+
6. Click **OK** to save the changes.
44+
45+
---

‎docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
title: "SEEK Bulk Import Warning: DLPEX Database Does Not Exist"
3+
sidebar_label: "SEEK Bulk Import Warning: DLPEX Database Does Not Exist"
4+
description: "Learn why the SEEK Bulk Import warning 'DLPEX database does not exist' appears and how to resolve it by verifying SEEK Scan completion and DLPEX database availability."
5+
keywords: [SEEK, DLPEX, T2 database, bulk import, SEEK Scan, data classification, import warning, Netwrix, scan failure, sensitive data]
6+
products: [enterprise-auditor, access-analyzer]
7+
knowledge_article_id: ka0Qk000000GKnZIAW
8+
---
9+
10+
## Related Queries
11+
12+
- "SEEK Bulk Import error DLPEX database does not exist."
13+
- "No sensitive data to import SEEK."
14+
- "SEEK import warning T2 not found."
15+
- "SEEK or SDD scan ran, but import fails."
16+
17+
## Symptom
18+
19+
When running a SEEK Bulk Import, the following warning is displayed:
20+
21+
```text
22+
WARNING | DLPEX database does not exist, there is no data to import.
23+
```
24+
25+
Despite the warning, the import process completes without any imported data.
26+
27+
## Cause
28+
29+
This warning indicates that the system attempted to import sensitive data (T2) from a host that does not have the required DLPEX database.
30+
This can occur due to one of the following reasons:
31+
32+
- **Unscanned hosts in the import list:** One or more hosts included in the bulk import were not scanned using SEEK Scan, and therefore, no DLPEX (T2) database was created.
33+
- **Scan failures:** The host experienced a catastrophic error during the SEEK Scan, which prevented the creation of the sensitive data (T2) database.
34+
35+
> **NOTE:**
36+
> If the import runs and simply finds no new data (but the database exists), no warning is shown and the import completes successfully.
37+
> The warning only appears if the expected DLPEX database is missing entirely.
38+
39+
## Resolution
40+
41+
To resolve this warning, follow these steps:
42+
43+
1. **Review the host list**
44+
- Confirm that all hosts listed in the SEEK Bulk Import are being scanned via SEEK Scan.
45+
- Remove any hosts from the list that are not currently scanned.
46+
47+
2. **Check scan results**
48+
- Investigate SEEK Scan logs for any failed scans.
49+
- Look for errors indicating that the DLPEX or T2 database could not be created.
50+
51+
3. **Rerun the scan**
52+
- Rerun the SEEK Scan on the affected hosts to generate the T2 database.
53+
54+
4. **Retry the bulk import**
55+
- Once scans have completed successfully and the DLPEX databases exist, rerun the SEEK Bulk Import.
56+
57+
---

0 commit comments

Comments
 (0)