netwrix · zoeycastillo · Nov 12, 2025 · Nov 12, 2025
@@ -26,11 +26,11 @@ This article contains references to the most popular Active Directory, Exchange,
 
 - [Alert Reported Change Made by System](/docs/kb/auditor/reports-alerts-and-notifications/report-generation/alert-reported-change-made-by-system.md).
 - [System Changed Object Path after Account Name Change](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/system-changed-object-path-after-account-name-change.md).
-- [System Changed Client Operating System](/docs/kb/auditor/system-changed-client-operating-system.md).
-- [System Changed Directory Objects for Foreign Security Principals](/docs/kb/auditor/system-changed-directory-objects-for-foreign-security-principals.md).
-- [Workstation Field Reported as Unknown](/docs/kb/auditor/workstation-field-reported-as-unknown.md)
-- [Duplicate Configuration and Schema Changes for All Monitored Domains in Forest Made by System](/docs/kb/auditor/duplicate-configuration-and-schema-changes-for-all-monitored-domains-in-forest-made-by-system.md).
-- [System Changed Service Principle Name Attribute](/docs/kb/auditor/system-changed-service-principle-name-attribute.md).
+- [System Changed Client Operating System](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/system-changed-client-operating-system.md).
+- [System Changed Directory Objects for Foreign Security Principals](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/system-changed-directory-objects-for-foreign-security-principals.md).
+- [Workstation Field Reported as Unknown](/docs/kb/auditor/reports-alerts-and-notifications/report-generation/workstation-field-reported-as-unknown.md)
+- [Duplicate Configuration and Schema Changes for All Monitored Domains in Forest Made by System](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/duplicate-configuration-and-schema-changes-for-all-monitored-domains-in-forest-made-by-system.md).
+- [System Changed Service Principle Name Attribute](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/system-changed-service-principle-name-attribute.md).
 
 
 

@@ -22,7 +22,7 @@ knowledge_article_id: kA04u000000PoL7CAK
 
 # Reducing the Used Active Directory and Entra ID License Counts
 
-> **IMPORTANT:** Netwrix Auditor is licensed per enabled Active Directory (AD) and Entra ID user object. For additional information on determining the number of enabled users, refer to the following articles: [Determining the Number of Enabled Active Directory User Accounts](/docs/kb/auditor/determining-the-number-of-enabled-active-directory-user-accounts.md) — [Determining the Number of Enabled Microsoft Entra ID Accounts](/docs/kb/auditor/determining-the-number-of-enabled-microsoft-entra-id-accounts.md). Netwrix Auditor only collects data from objects that are not excluded (omitted), which means that any objects that are omitted will not be monitored.
+> **IMPORTANT:** Netwrix Auditor is licensed per enabled Active Directory (AD) and Entra ID user object. For additional information on determining the number of enabled users, refer to the following articles: [Determining the Number of Enabled Active Directory User Accounts](/docs/kb/auditor/configuration-and-setup/active-directory-auditing/determining-the-number-of-enabled-active-directory-user-accounts.md) — [Determining the Number of Enabled Microsoft Entra ID Accounts](/docs/kb/auditor/configuration-and-setup/microsoft-365-integration/determining-the-number-of-enabled-microsoft-entra-id-accounts.md). Netwrix Auditor only collects data from objects that are not excluded (omitted), which means that any objects that are omitted will not be monitored.
 
 ## Question
 
@@ -95,10 +95,7 @@ To exclude specific Entra ID users from the license count, populate the `omitUPN
 
 ## Related Links
 
-- [Determining the Number of Enabled Active Directory User Accounts](/docs/kb/auditor/determining-the-number-of-enabled-active-directory-user-accounts.md)
-- [Determining the Number of Enabled Microsoft Entra ID Accounts](/docs/kb/auditor/determining-the-number-of-enabled-microsoft-entra-id-accounts.md)
+- [Determining the Number of Enabled Active Directory User Accounts](/docs/kb/auditor/configuration-and-setup/active-directory-auditing/determining-the-number-of-enabled-active-directory-user-accounts.md)
+- [Determining the Number of Enabled Microsoft Entra ID Accounts](/docs/kb/auditor/configuration-and-setup/microsoft-365-integration/determining-the-number-of-enabled-microsoft-entra-id-accounts.md)
 - [Active Directory Monitoring Scope](https://docs.netwrix.com/docs/auditor/10_8)
 - [Microsoft Entra ID Monitoring Scope](https://docs.netwrix.com/docs/auditor/10_8)
-
-
-
@@ -43,7 +43,7 @@ Since the product associates Session IDs with the current session of the user, t
 
 ### Related Article
 
-- [How Does Merging Logon Activity Events Work?](/docs/kb/auditor/how-does-merging-logon-activity-events-work.md)
+- [How Does Merging Logon Activity Events Work?](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-does-merging-logon-activity-events-work.md)
 
 
 
@@ -33,7 +33,7 @@ How to repair a Netwrix Auditor installation in our environment?
 > Stop-Service -Displayname Netwrix*
 > ```
 
-1. Establish the Netwrix Auditor version and build you're currently running in your environment. Refer to the following article for additional information: [How to Find Out My Netwrix Auditor Version](/docs/kb/auditor/how-to-find-out-my-netwrix-auditor-version.md).
+1. Establish the Netwrix Auditor version and build you're currently running in your environment. Refer to the following article for additional information: [How to Find Out My Netwrix Auditor Version](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-find-out-my-netwrix-auditor-version.md).
 2. Proceed to your **My Products** page to download the executable for the corresponding version. Refer to the following link: [Netwrix — My Products](https://www.netwrix.com/my_products.html).
 3. Run the downloaded executable. Once the files are extracted, a setup screen will be prompted.
 
@@ -47,7 +47,7 @@ How to repair a Netwrix Auditor installation in our environment?
 
 ## Related articles
 
-- [How to Find Out My Netwrix Auditor Version](/docs/kb/auditor/how-to-find-out-my-netwrix-auditor-version.md)
+- [How to Find Out My Netwrix Auditor Version](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-find-out-my-netwrix-auditor-version.md)
 
 
 
@@ -23,40 +23,40 @@ This is a reference list of articles on troubleshooting errors in SharePoint Ser
 
 - [SharePoint Core Service Deployment Failed](/docs/kb/auditor/configuration-and-setup/sharepoint-and-teams-auditing/sharepoint-core-service-deployment-failed.md)
 - [Timeout Expired Error on SharePoint Core Service D](/docs/kb/auditor/configuration-and-setup/sharepoint-and-teams-auditing/timeout-expired-error-on-sharepoint-core-service-deployment.md)
-- [Event ID 1204 in Health Log](/docs/kb/auditor/event-id-1204-in-health-log.md)
-- [Event ID 1205 in Health Log](/docs/kb/auditor/event-id-1205-in-health-log.md)
-- [Error: Event ID 1206 in Health Log](/docs/kb/auditor/error-event-id-1206-in-health-log.md)
-- [Event ID 1208 in Health Log](/docs/kb/auditor/event-id-1208-in-health-log.md)
-- [Event ID 1209 in Health Log](/docs/kb/auditor/event-id-1209-in-health-log.md)
-- [Event ID 1210 in Health Log](/docs/kb/auditor/event-id-1210-in-health-log.md)
-- [Event ID 1214 in Health Log](/docs/kb/auditor/event-id-1214-in-health-log.md)
-- [Event ID 1223 in Health Log](/docs/kb/auditor/event-id-1223-in-health-log.md)
-- [Event ID 1225 in Health Log](/docs/kb/auditor/event-id-1225-in-health-log.md)
-- [Event ID 1236 in Health Log](/docs/kb/auditor/event-id-1236-in-health-log.md)
-- [Event ID 1237/1238 in Health Log](/docs/kb/auditor/event_id_12371238_in_health_log.md)
-- [Event ID 1239 in Health Log](/docs/kb/auditor/event-id-1239-in-health-log.md)
-- [Event ID 1240 in Health Log](/docs/kb/auditor/event-id-1240-in-health-log.md)
-- [Event ID 1241 in Health Log](/docs/kb/auditor/event-id-1241-in-health-log.md)
-- [Event ID 1242 in Health Log](/docs/kb/auditor/event-id-1242-in-health-log.md)
-- [Event ID 1243 in Health Log](/docs/kb/auditor/event-id-1243-in-health-log.md)
-- [Event ID 1244 in Health Log](/docs/kb/auditor/event-id-1244-in-health-log.md)
-- [Event ID 1245 in Health Log](/docs/kb/auditor/event-id-1245-in-health-log.md)
-- [Event ID 1249 in Health Log](/docs/kb/auditor/event-id-1249-in-health-log.md)
-- [Event ID 1250 in Health Log](/docs/kb/auditor/event-id-1250-in-health-log.md)
-- [Event ID 1251 - 1254, 1256 - 1258 in Health Log](/docs/kb/auditor/event-id-1251-1254-1256-1258-in-health-log.md)
-- [Event ID 1255 in Health Log](/docs/kb/auditor/event-id-1255-in-health-log.md)
-- [Event ID 1259 in Health Log](/docs/kb/auditor/event-id-1259-in-health-log.md)
-- [Event ID 1260 − 1266 in Health Log](/docs/kb/auditor/event-id-1260-1266-in-health-log.md)
-- [Event ID 1267 − 1273 in Health Log](/docs/kb/auditor/event-id-1267-1273-in-health-log.md)
-- [Event ID 1274 in Health Log](/docs/kb/auditor/event-id-1274-in-health-log.md)
-- [Event ID 1275 in Health Log](/docs/kb/auditor/event-id-1275-in-health-log.md)
-- [Event ID 1276 in Health Log](/docs/kb/auditor/event-id-1276-in-health-log.md)
-- [Event ID 1280 in Health Log](/docs/kb/auditor/event-id-1280-in-health-log.md)
-- [Event ID 1285 in Health Log](/docs/kb/auditor/event-id-1285-in-health-log.md)
-- [Event ID 1286 in Health Log](/docs/kb/auditor/event-id-1286-in-health-log.md)
-- [Event ID 1287 in Health Log](/docs/kb/auditor/event-id-1287-in-health-log.md)
-- [Event ID 1288 in Health Log](/docs/kb/auditor/event-id-1288-in-health-log.md)
-- [Event ID 1289 in Health Log](/docs/kb/auditor/event-id-1289-in-health-log.md)
+- [Event ID 1204 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1204-in-health-log.md)
+- [Event ID 1205 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1205-in-health-log.md)
+- [Error: Event ID 1206 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/error-event-id-1206-in-health-log.md)
+- [Event ID 1208 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1208-in-health-log.md)
+- [Event ID 1209 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1209-in-health-log.md)
+- [Event ID 1210 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1210-in-health-log.md)
+- [Event ID 1214 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1214-in-health-log.md)
+- [Event ID 1223 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1223-in-health-log.md)
+- [Event ID 1225 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1225-in-health-log.md)
+- [Event ID 1236 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1236-in-health-log.md)
+- [Event ID 1237/1238 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event_id_12371238_in_health_log.md)
+- [Event ID 1239 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1239-in-health-log.md)
+- [Event ID 1240 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1240-in-health-log.md)
+- [Event ID 1241 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1241-in-health-log.md)
+- [Event ID 1242 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1242-in-health-log.md)
+- [Event ID 1243 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1243-in-health-log.md)
+- [Event ID 1244 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1244-in-health-log.md)
+- [Event ID 1245 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1245-in-health-log.md)
+- [Event ID 1249 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1249-in-health-log.md)
+- [Event ID 1250 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1250-in-health-log.md)
+- [Event ID 1251 - 1254, 1256 - 1258 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1251-1254-1256-1258-in-health-log.md)
+- [Event ID 1255 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1255-in-health-log.md)
+- [Event ID 1259 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1259-in-health-log.md)
+- [Event ID 1260 − 1266 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1260-1266-in-health-log.md)
+- [Event ID 1267 − 1273 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1267-1273-in-health-log.md)
+- [Event ID 1274 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1274-in-health-log.md)
+- [Event ID 1275 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1275-in-health-log.md)
+- [Event ID 1276 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1276-in-health-log.md)
+- [Event ID 1280 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1280-in-health-log.md)
+- [Event ID 1285 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1285-in-health-log.md)
+- [Event ID 1286 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1286-in-health-log.md)
+- [Event ID 1287 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1287-in-health-log.md)
+- [Event ID 1288 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1288-in-health-log.md)
+- [Event ID 1289 in Health Log](/docs/kb/auditor/event-id-reference/health-log-events/event-id-1289-in-health-log.md)
 
 
 

@@ -50,7 +50,7 @@ Yes, you are able to migrate audit databases to another Microsoft SQL Server ins
    3. Under the **Source** section, select the **Device** option, and click **...** to browse for databases.
    4. In the **Specify Backup Devices** window, click **Add** and select the backup database file. Click **OK**.
    5. Specify the database name and check the **Restore** checkbox under the **Backup sets to restore** section.
-5. Deploy the new Report Database. For more information, see [Deploying the Report Server Database](/docs/kb/auditor/deploying-the-report-server-database.md)
+5. Deploy the new Report Database. For more information, see [Deploying the Report Server Database](/docs/kb/auditor/system-administration/database-management/deploying-the-report-server-database.md)
 6. Stop the old **SQL Server (%instance_name%)** service.
 7. Start `Netwrix Auditor Archive Service` and `Netwrix Auditor Management Service`.
 8. In the main Netwrix Auditor menu, select **Settings** > **Audit Database** tab, and specify the new SQL Server and Reporting Service settings.
@@ -68,6 +68,6 @@ Yes, you are able to migrate audit databases to another Microsoft SQL Server ins
 
 - [How to Assign db_owner Permissions](docs/kb/auditor/how-to-assign-db-owner-permissions.md)
 - [SQL Server Reporting Services](https://docs.netwrix.com/docs/auditor/10_8/requirements/overview)
-- [How to Prepare the Netwrix Server for a SQL Upgrade](/docs/kb/auditor/how-to-prepare-the-netwrix-server-for-a-sql-upgrade.md)
-- [Deploying the Report Server Database](/docs/kb/auditor/deploying-the-report-server-database.md)
+- [How to Prepare the Netwrix Server for a SQL Upgrade](/docs/kb/auditor/system-administration/migration-and-upgrade/how-to-prepare-the-netwrix-server-for-a-sql-upgrade.md)
+- [Deploying the Report Server Database](/docs/kb/auditor/system-administration/database-management/deploying-the-report-server-database.md)
 
@@ -32,4 +32,4 @@ Is it possible to have both: Netwrix Data Classification (NDC) SQL database and
 
 Netwrix strongly recommends **do not keep** these databases on the same SQL Server. This may lead to significant performance loss.
 
-If, for some reasons, you need to migrate your Netwrix Data Classification (NDC) SQL database to another server, refer to the following article for additional information: [How to Migrate the Netwrix Data Classification Database](/docs/kb/dataclassification/how-to-migrate-the-netwrix-data-classification-database.md).
+If, for some reasons, you need to migrate your Netwrix Data Classification (NDC) SQL database to another server, refer to the following article for additional information: [How to Migrate the Netwrix Data Classification Database](/docs/kb/dataclassification/migration-and-maintenance/how-to-migrate-the-netwrix-data-classification-database.md).
@@ -74,5 +74,5 @@ While it is highly recommended to implement either a SQL Server Standard or Ente
 
 - [Investigations](https://docs.netwrix.com/docs/auditor/10_8/admin/settings/investigations)
 - [How to Reduce Audit Database Size for Netwrix Auditor](/docs/kb/auditor/system-administration/database-management/how-to-reduce-audit-database-size-for-netwrix-auditor.md) 
-- [Could Not Allocate Space for Object (ObjectName) in Database (DatabaseName)](/docs/kb/auditor/could-not-allocate-space-for-object-objectname-in-database-databasename.md)
+- [Could Not Allocate Space for Object (ObjectName) in Database (DatabaseName)](/docs/kb/auditor/system-administration/database-management/could-not-allocate-space-for-object-objectname-in-database-databasename.md)
 
@@ -107,5 +107,5 @@ The Windows Server Auditing host and compression service cannot operate due to d
 
 ## Related articles
 
-- [Сonnection Issue when TLS 1.2 Is Required](/docs/kb/auditor/сonnection_issue_when_tls_1.2_is_required.md)
-- [Client and Server Cannot Communicate, Because They Do Not Possess a Common Algorithm](/docs/kb/auditor/client-and-server-cannot-communicate-because-they-do-not-possess-a-common-algorithm.md)
+- [Сonnection Issue when TLS 1.2 Is Required](/docs/kb/auditor/troubleshooting-and-errors/ssl-tls-certificate-issues/сonnection_issue_when_tls_1.2_is_required.md)
+- [Client and Server Cannot Communicate, Because They Do Not Possess a Common Algorithm](/docs/kb/auditor/troubleshooting-and-errors/data-collection-errors/client-and-server-cannot-communicate-because-they-do-not-possess-a-common-algorithm.md)
@@ -36,7 +36,7 @@ products:
 ## Resolutions
 
 - Enable TLS 1.2 in your environment − refer to the following article for additional information: Connection Issue when TLS 1.2 Is Required.
-- In case TLS protocol versions are limited to specific versions in your environment, make sure to allow the operating system to select the protocol for incoming and outgoing communication. Refer to the following article for additional information: [Client and Server Cannot Communicate, Because They Do Not Possess a Common Algorithm](/docs/kb/auditor/client-and-server-cannot-communicate-because-they-do-not-possess-a-common-algorithm.md).
+- In case TLS protocol versions are limited to specific versions in your environment, make sure to allow the operating system to select the protocol for incoming and outgoing communication. Refer to the following article for additional information: [Client and Server Cannot Communicate, Because They Do Not Possess a Common Algorithm](/docs/kb/auditor/troubleshooting-and-errors/data-collection-errors/client-and-server-cannot-communicate-because-they-do-not-possess-a-common-algorithm.md).
 - Review the certificate used for Windows Server auditing:
   1. In the Netwrix Auditor server, either press **Win + R** or launch the **Run** command window.
   2. In the **Run** command window, type `mmc` and press **OK**. Select **Yes** in the following prompt.
@@ -52,4 +52,4 @@ products:
 ## Related Articles
 
 - Connection Issue when TLS 1.2 Is Required
-- [Client and Server Cannot Communicate, Because They Do Not Possess a Common Algorithm](/docs/kb/auditor/client-and-server-cannot-communicate-because-they-do-not-possess-a-common-algorithm.md)
+- [Client and Server Cannot Communicate, Because They Do Not Possess a Common Algorithm](/docs/kb/auditor/troubleshooting-and-errors/data-collection-errors/client-and-server-cannot-communicate-because-they-do-not-possess-a-common-algorithm.md)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -43,7 +43,7 @@ Since the product associates Session IDs with the current session of the user, t

		### Related Article

		- [How Does Merging Logon Activity Events Work?](/docs/kb/auditor/how-does-merging-logon-activity-events-work.md)
		- [How Does Merging Logon Activity Events Work?](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-does-merging-logon-activity-events-work.md)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -32,4 +32,4 @@ Is it possible to have both: Netwrix Data Classification (NDC) SQL database and

		Netwrix strongly recommends do not keep these databases on the same SQL Server. This may lead to significant performance loss.

		If, for some reasons, you need to migrate your Netwrix Data Classification (NDC) SQL database to another server, refer to the following article for additional information: [How to Migrate the Netwrix Data Classification Database](/docs/kb/dataclassification/how-to-migrate-the-netwrix-data-classification-database.md).
		If, for some reasons, you need to migrate your Netwrix Data Classification (NDC) SQL database to another server, refer to the following article for additional information: [How to Migrate the Netwrix Data Classification Database](/docs/kb/dataclassification/migration-and-maintenance/how-to-migrate-the-netwrix-data-classification-database.md).