2 replies to this topic

[MarkDym]

Hi

 

Could not see a 'general' auditor forum so posted here. We use the free edition of Netwrix Auditor to monitor password expiration, Active Directory changes and Group Policy changes.

 

I am struggling to install other software on the server on which Netwrix Auditor is installed. The installation cannot proceed because the installer has detected file rename operations that require a reboot to complete.

 

I have rebooted the server several times but these remain.

 

I have looked at the contents of the entries under:

 

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations

HKLM\SYSTEM\CurrentControlSet001\Control\Session Manager\PendingFileRenameOperations

HKLM\SYSTEM\CurrentControlSet002\Control\Session Manager\PendingFileRenameOperations

 

The first entry cleared after a restart but the 001 and 002 entries remain populated. They contain:

 

\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\3b268ad5-fd5c-457c-b2f6-fdb32fcf828f.tmp

 

\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\98fa221b-5097-41be-9792-7451f605521f.tmp

 

\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\c6217e59-00f6-4659-be76-49b0f3efd032.tmp

 

\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\b667bef2-3495-4d4d-9021-de5934715321.tmp

 

\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\8a3b1940-42e6-44e3-af6b-2599480cb7c0.tmp

 

\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\0e2b9b38-13c5-4aeb-8861-f9de1b61a5a9.tmp

 

etc.

 

Various blog posts state these keys can be deleted or renamed. However, I did not wish to do this without understanding the impact this might have on Netwrix Auditor.

 

Can someone confirm the best way to deal with this, please? Can they be deleted, or should they be renamed, and then changed back after the software installation has completed?

 

Also, are there any other locations in the registry that need to be checked?

 

Many thanks

 

Mark

[Jadentek]

@MarkDym

 

Being that there is not an option to use reporting with the freeware as long as you received the Change summary from the days these temp (.tmp) files were created then they should be good to delete or at least delete the reg key saying that these files need to be renamed.

[MarkDym]

@MarkDym

 

Being that there is not an option to use reporting with the freeware as long as you received the Change summary from the days these temp (.tmp) files were created then they should be good to delete or at least delete the reg key saying that these files need to be renamed.

Hi, Jadentek, thanks for responding. I'm quite happy to delete/rename the PendingFileRenameOperations but I don't understand what the tmp files do. You say they are to do with reporting, but I can't see any reference to that.

 

I will wait a few days and see if if any mods/tech staff can confirm that.

 

Thanks again.