Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ keywords:
products:
- access-analyzer
sidebar_label: 'Active Directory Permissions Analyzer reports are '
tags: []
tags:
- active-directory-auditing
title: "Active Directory Permissions Analyzer reports are outdated"
knowledge_article_id: kA04u000000HDhRCAW
---
Expand All @@ -27,7 +28,7 @@ knowledge_article_id: kA04u000000HDhRCAW

Old data in the Active Directory Permissions Analyzer **(ADPA)** reports from deprecated Domains.
Example of the incorrect data:
![Chart Description automatically generated](./images/ka04u000000HdDV_0EM4u0000084aiy.png)
![Chart Description automatically generated](./../0-images/ka04u000000HdDV_0EM4u0000084aiy.png)

## Cause

Expand All @@ -41,28 +42,28 @@ To do so you can follow the steps below.

1. Create a new Job in the Netwrix Auditor console: right click the **Jobs Node** in the left-hand window and select **Create Job**:

![Graphical user interface, application Description automatically generated](./images/ka04u000000HdDV_0EM4u0000084aiz.png)
![Graphical user interface, application Description automatically generated](./../0-images/ka04u000000HdDV_0EM4u0000084aiz.png)

Select the **Local host** in the jobs host list:

![Graphical user interface, application Description automatically generated](./images/ka04u000000HdDV_0EM4u0000084aj0.png)
![Graphical user interface, application Description automatically generated](./../0-images/ka04u000000HdDV_0EM4u0000084aj0.png)

2. Click on the **Create Query**:

![Graphical user interface, application, Word Description automatically generated](./images/ka04u000000HdDV_0EM4u0000084aj1.png)
![Graphical user interface, application, Word Description automatically generated](./../0-images/ka04u000000HdDV_0EM4u0000084aj1.png)

3. Configure the jobs query Properties.
Under the **Data Sources** tab, select the **ADPERMISSIONS** option from the dropdown menu then click on **Configure**.

![Graphical user interface, application, Word Description automatically generated](./images/ka04u000000HdDV_0EM4u0000084aj2.png)
![Graphical user interface, application, Word Description automatically generated](./../0-images/ka04u000000HdDV_0EM4u0000084aj2.png)

Select **Remove Tables** and click **Next**:

![Graphical user interface, text, application, email Description automatically generated](./images/ka04u000000HdDV_0EM4u0000084aj3.png)
![Graphical user interface, text, application, email Description automatically generated](./../0-images/ka04u000000HdDV_0EM4u0000084aj3.png)

Check the Results option: Click **Next** → **Finish** → **Ok**.

![Graphical user interface, text, application Description automatically generated](./images/ka04u000000HdDV_0EM4u0000084aj4.png)
![Graphical user interface, text, application Description automatically generated](./../0-images/ka04u000000HdDV_0EM4u0000084aj4.png)

4. Now run the new Job.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@ keywords:
products:
- access-analyzer
sidebar_label: AD_SecurityAssessment Explained
tags: []
tags:
- active-directory-auditing
title: "AD_SecurityAssessment Explained"
knowledge_article_id: kA0Qk0000001gV3KAI
---
Expand Down Expand Up @@ -112,4 +113,3 @@ Where does the AD_SecurityAssessment report get the data for it's categories and
| Trusts | Foreign Security Principals in admin groups | `SA_ADInventory_DistinguishedNames` | `.Active Directory Inventory\1-AD_Scan` |
| Trusts | Insecure trust configuration | `SA_AD_DomainInfo_TrustDetails` | `Active Directory\5. Domains\AD_DomainInfo` |
| Trusts | Outbound trust with SID History enabled | `SA_AD_DomainInfo_Filtering` | `Active Directory\5. Domains\AD_DomainInfo` |

Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Built-in Users Group Permissions
tags: []
tags:
- active-directory-auditing
title: "Built-in Users Group Permissions"
knowledge_article_id: kA0Qk0000001JDVKA2
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Collecting AD Summary
tags: []
tags:
- active-directory-auditing
title: "Collecting AD Summary"
knowledge_article_id: kA04u000000LLkXCAW
---
Expand All @@ -31,9 +32,9 @@ Licensing of Netwrix Access Analyzer is based on the quantity of enabled AD user
To find this data:

1. Ensure **.Active Directory Inventory** has recently run or run now. Navigate to **Jobs** > **.Active Directory Inventory** > **1-AD_Scan** and click **Run Now**
![Group_001.png](./images/ka0Qk000000Dl4L_0EM4u000008M8wx.png)
![Group_001.png](./../0-images/ka0Qk000000Dl4L_0EM4u000008M8wx.png)

2. Navigate to **Jobs** > **.Active Directory Inventory** > **1-AD_Scan** > **Results** > **Active Directory Summary**

3. Take a screenshot or otherwise capture the values displayed in **Total Users** and **Disabled Users**
![Group_002.png](./images/ka0Qk000000Dl4L_0EM4u000008M8x2.png)
![Group_002.png](./../0-images/ka0Qk000000Dl4L_0EM4u000008M8x2.png)
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Deleted AD User(s) Still Show In Netwrix Access An
tags: []
tags:
- active-directory-auditing
title: "Deleted AD User(s) Still Show In Netwrix Access Analyzer Reports"
knowledge_article_id: kA0Qk0000001i73KAA
---
Expand All @@ -35,9 +36,9 @@ A failure on the ADI scan that could be caused by a myriad of reasons.
Run a full **AD Inventory Scan** by disabling differential scanning for the **1-AD_Scan** job using the steps below:

1. Navigate to **Access Analyzer > Jobs > .Active Directory Inventory > 1-AD_Scan > Configure > Queries > Query Properties > Configure > Options**.
![Image_2024-11-19_15-36-30.png](./images/ka0Qk000000DYa9_0EMQk00000AdoIX.png)
![Image_2024-11-19_15-36-30.png](./../0-images/ka0Qk000000DYa9_0EMQk00000AdoIX.png)
2. Uncheck the box for **Collect only updates since the last scan**.
![Image_2024-11-19_15-37-33.png](./images/ka0Qk000000DYa9_0EMQk00000AdoSD.png)
![Image_2024-11-19_15-37-33.png](./../0-images/ka0Qk000000DYa9_0EMQk00000AdoSD.png)
3. Click **Next** through the end of the Active Directory Inventory DC Wizard.
4. Re-run the **1-AD_Scan** job.
5. Select the previously-unchecked box for **Collect only updates since the last scan**.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Deleted Objects in ADInventory
tags: []
tags:
- active-directory-auditing
title: "Deleted Objects in ADInventory"
knowledge_article_id: kA04u0000000IpGCAU
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ keywords:
products:
- access-analyzer
sidebar_label: isDeleted not being checked in ADI scans
tags: []
tags:
- active-directory-auditing
title: "isDeleted not being checked in ADI scans"
knowledge_article_id: kA04u0000000IPgCAM
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@ products:
- access-analyzer
- access_info_center
sidebar_label: Missing Groups in AIC Access Groups
tags: []
tags:
- active-directory-auditing
title: "Missing Groups in AIC Access Groups"
knowledge_article_id: kA0Qk0000000aOTKAY
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Remove Domain Audit Data from Reports − Drop Domai
tags: []
tags:
- active-directory-auditing
title: "Remove Domain Audit Data from Reports − Drop Domains"
knowledge_article_id: kA0Qk0000000R3RKAU
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Connection Profile Credential Selection
tags: []
tags:
- connection-profiles-and-credentials
title: "Connection Profile Credential Selection"
knowledge_article_id: kA04u0000000IwpCAE
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Using SQL Style Credentials in Access Analyzer
tags: []
tags:
- connection-profiles-and-credentials
title: "Using SQL Style Credentials in Access Analyzer"
knowledge_article_id: kA04u0000000INaCAM
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Audit MySQL Databases in Netwrix Access Analyzer
tags: []
tags:
- database-auditing-and-configuration
title: "Audit MySQL Databases in Netwrix Access Analyzer"
knowledge_article_id: kA04u00000111GvCAI
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Audit PostgreSQL Databases in Netwrix Access Analy
tags: []
tags:
- database-auditing-and-configuration
title: "Audit PostgreSQL Databases in Netwrix Access Analyzer"
knowledge_article_id: kA04u00000111H0CAI
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ products:
- access-analyzer
- access_info_center
sidebar_label: 'How to Drop Data Collected from SQL Servers Using '
tags: []
tags:
- database-auditing-and-configuration
title: "How to Drop Data Collected from SQL Servers Using the Databases Module"
knowledge_article_id: kA0Qk0000001lGDKAY
---
Expand All @@ -36,32 +37,32 @@ This article explains how to drop data collected from SQL Servers using the Data
> **NOTE:** You can create a separate folder (e.g., Sandbox) for custom jobs.

1. Right-click the **custom** or **Jobs** folder and select **Create Job** `Ctrl+Alt+A`.
![ ](./images/ka0Qk000000DG6z_0EMQk00000BvYY7.png)
![ ](./../0-images/ka0Qk000000DG6z_0EMQk00000BvYY7.png)
2. Navigate to the **Configure** node of the NewJob and select the **Queries** node.
![ ](./images/ka0Qk000000DG6z_0EMQk00000BvhTJ.png)
![ ](./../0-images/ka0Qk000000DG6z_0EMQk00000BvhTJ.png)
3. Click the **Create Query** button.
![ ](./images/ka0Qk000000DG6z_0EMQk00000BvhZl.png)
![ ](./../0-images/ka0Qk000000DG6z_0EMQk00000BvhZl.png)
4. In the General tab, designate a clear **Name** and **Description** (e.g., `DropSQLHostData`).
5. In the Data Source tab, select **SQL** from the **Data Collector** dropdown menu.
![ ](./images/ka0Qk000000DG6z_0EMQk00000Bvheb.png)
![ ](./../0-images/ka0Qk000000DG6z_0EMQk00000Bvheb.png)
6. Click **Configure** to launch the SQL Data Collector Configuration Wizard.
![ ](./images/ka0Qk000000DG6z_0EMQk00000BvhgD.png)
![ ](./../0-images/ka0Qk000000DG6z_0EMQk00000BvhgD.png)
7. On the Wizard Category page, select the **Utilities > Remove Storage Tables** option under the appropriate database type and click **Next** to drop all collected SQL data for SQL Servers.
![Category page with Utilities > Remove Storage Tables option highlighted](./images/ka0Qk000000DG6z_0EMQk00000BvdWA.png)
![Category page with Utilities > Remove Storage Tables option highlighted](./../0-images/ka0Qk000000DG6z_0EMQk00000BvdWA.png)
8. To complete the query, ensure you have selected the desired Available Properties, click **Next**, and then **Finish**. Last, click **OK**.
9. To run the job, you can either select **Run now** from the job windowpane or right-click the job and select **Run Job**.
![ ](./images/ka0Qk000000DG6z_0EMQk00000Bvjzl.png)
![ ](./../0-images/ka0Qk000000DG6z_0EMQk00000Bvjzl.png)

### Drop Data for Specific Hosts/Instances for SQL Servers or Drop Specific Data for SQL Hosts/Instances

1. Follow steps 1–6 detailed above.
2. On the SQL Data Collector Configuration Wizard Category page, select the **Utilities > Remove Storage Data** option and click **Next**.
![Category page with Utilities > Remove Storage Data option highlighted](./images/ka0Qk000000DG6z_0EMQk00000Bvk6D.png)
![Category page with Utilities > Remove Storage Data option highlighted](./../0-images/ka0Qk000000DG6z_0EMQk00000Bvk6D.png)
3. On the Filters page, select the databases/instances via the **Filter Options** drop-down menu:
- All database objects
- Only select database objects
- When using this option, select the database objects you want to delete in the **Available database objects** pane, then click **Add**.
![Available database objects pane with Add highlighted](./images/ka0Qk000000DG6z_0EMQk00000Bvbfg.png)
![Available database objects pane with Add highlighted](./../0-images/ka0Qk000000DG6z_0EMQk00000Bvbfg.png)
4. On the Settings page, select the type of data you would like to remove for your specified hosts:
- Permissions
- Audits
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@ keywords:
products:
- access-analyzer
sidebar_label: How to Identify Active Transactions Filling the Te
tags: []
tags:
- database-auditing-and-configuration
title: "How to Identify Active Transactions Filling the TempDB"
knowledge_article_id: kA0Qk0000001sETKAY
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Several SQL Database Servers Experience Failed Sca
tags: []
tags:
- database-auditing-and-configuration
title: "Several SQL Database Servers Experience Failed Scans"
knowledge_article_id: kA0Qk0000000aMrKAI
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ keywords:
products:
- access-analyzer
sidebar_label: "Error: ExecuteScalar Requires an Open and Available Connection"
tags: []
tags:
- entra-id-and-azure-integration
title: "Error: ExecuteScalar Requires an Open and Available Connection During Entra ID Collection"
knowledge_article_id: kA0Qk0000002AZZKA2
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ keywords:
products:
- access-analyzer
sidebar_label: 'Manually Setting Up Entra ID Auditing for Netwrix '
tags: []
tags:
- entra-id-and-azure-integration
title: "Manually Setting Up Entra ID Auditing for Netwrix Access Analyzer"
knowledge_article_id: kA0Qk00000022IfKAI
---
Expand All @@ -36,17 +37,17 @@ While it is always recommended to use the `AZ_RegisterAzureAppAuth` instant job
1. Open the Microsoft Entra admin center: https://entra.microsoft.com/#home.

2. Navigate to **Identity > Applications > App registrations** and select **+ New registration**.
![Entra App Registration](./images/ka0Qk000000DYVJ_0EMQk00000B6ziP.png)
![Entra App Registration](./../0-images/ka0Qk000000DYVJ_0EMQk00000B6ziP.png)

3. On the **Register an application** page, set the following:
- **Name:** Something meaningful, e.g., `NEA_EntraID`.
- **Support account types:** Accounts in this org. directory only.

4. From the **Application Overview** page, navigate to **Manage > API Permissions** and select **Add a permission**.
![API Permissions](./images/ka0Qk000000DYVJ_0EMQk00000B6i4s.png)
![API Permissions](./../0-images/ka0Qk000000DYVJ_0EMQk00000B6i4s.png)

5. From the **Request API permissions** page, select **Microsoft Graph**.
![Request API permissions](./images/ka0Qk000000DYVJ_0EMQk00000B6qwr.png)
![Request API permissions](./../0-images/ka0Qk000000DYVJ_0EMQk00000B6qwr.png)

- Add the following **Delegated Permissions**:
- `Group.Read.All` – Read all groups
Expand All @@ -56,20 +57,20 @@ While it is always recommended to use the `AZ_RegisterAzureAppAuth` instant job
- `Directory.Read.All` – Read directory data

6. After adding the aforementioned permissions, grant them admin consent by selecting **Grant admin consent for `\{TENANT NAME\}`**.
![Grant admin consent](./images/ka0Qk000000DYVJ_0EMQk00000B6f5O.png)
![Grant admin consent](./../0-images/ka0Qk000000DYVJ_0EMQk00000B6f5O.png)

7. Navigate to the Entra app registration and on the **Certificates & secrets** page, select **+ New client secret**.
![Certificates & secrets](./images/ka0Qk000000DYVJ_0EMQk00000B6fbf.png)
![Certificates & secrets](./../0-images/ka0Qk000000DYVJ_0EMQk00000B6fbf.png)

8. On the **Add a client secret** page, add the following:
- **Description:** Something meaningful, e.g., `Access Analyzer Entra ID`.
- **Expires:** Usually recommended to set this to the longest option OR per the organization’s internal certificate expiration timeframe.

9. After creating the client secret, copy the secret **Value** to a notepad.
![Client secret value](./images/ka0Qk000000DYVJ_0EMQk00000B6d20.png)
![Client secret value](./../0-images/ka0Qk000000DYVJ_0EMQk00000B6d20.png)

10. Next, navigate to the **Overview** tab and copy the **Application (client) ID** which is needed for the Netwrix Access Analyzer Connection Profile.
![Application client ID](./images/ka0Qk000000DYVJ_0EMQk00000B6kbK.png)
![Application client ID](./../0-images/ka0Qk000000DYVJ_0EMQk00000B6kbK.png)

## Netwrix Access Analyzer Connection Profile

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Scanning Multiple Microsoft Entra Tenants
tags: []
tags:
- entra-id-and-azure-integration
title: "Scanning Multiple Microsoft Entra Tenants"
knowledge_article_id: kA04u0000000IhiCAE
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ keywords:
products:
- access-analyzer
sidebar_label: 'Using the AADI_RegisterAzureAppAuth Job to Create '
tags: []
tags:
- entra-id-and-azure-integration
title: >-
Using the AADI_RegisterAzureAppAuth Job to Create the Modern Auth Connection
Profile for Entra ID
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ keywords:
- Entra
- Access Analyzer
sidebar_label: PowerShell Modules for O365 Configuration
tags: []
tags:
- exchange-online-integration
title: "PowerShell Modules Required for O365 Configuration"
knowledge_article_id: kA0Qk0000001i3pKAA
products:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ keywords:
products:
- access-analyzer
sidebar_label: Retirement of RBAC Application Impersonation in Ex
tags: []
tags:
- exchange-online-integration
title: "Retirement of RBAC Application Impersonation in Exchange Online"
knowledge_article_id: kA0Qk0000001q4bKAA
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@ keywords:
- Exchange Online
- Netwrix Access Analyzer
sidebar_label: PowerShell Error in Netwrix Access Analyzer
tags: []
tags:
- exchange-online-integration
title: "System.Exception − New-ExoPSSession PowerShell Error in Netwrix Access Analyzer"
knowledge_article_id: kA04u00000111IrCAI
products:
Expand Down
Loading
Loading