Hi
Could not see a 'general' auditor forum so posted here. We use the free edition of Netwrix Auditor to monitor password expiration, Active Directory changes and Group Policy changes.
I am struggling to install other software on the server on which Netwrix Auditor is installed. The installation cannot proceed because the installer has detected file rename operations that require a reboot to complete.
I have rebooted the server several times but these remain.
I have looked at the contents of the entries under:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
HKLM\SYSTEM\CurrentControlSet001\Control\Session Manager\PendingFileRenameOperations
HKLM\SYSTEM\CurrentControlSet002\Control\Session Manager\PendingFileRenameOperations
The first entry cleared after a restart but the 001 and 002 entries remain populated. They contain:
\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\3b268ad5-fd5c-457c-b2f6-fdb32fcf828f.tmp
\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\98fa221b-5097-41be-9792-7451f605521f.tmp
\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\c6217e59-00f6-4659-be76-49b0f3efd032.tmp
\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\b667bef2-3495-4d4d-9021-de5934715321.tmp
\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\8a3b1940-42e6-44e3-af6b-2599480cb7c0.tmp
\??\C:\ProgramData\Netwrix Auditor\ShortTerm\AD Changes\STA\htlincs.local\Status\0e2b9b38-13c5-4aeb-8861-f9de1b61a5a9.tmp
etc.
Various blog posts state these keys can be deleted or renamed. However, I did not wish to do this without understanding the impact this might have on Netwrix Auditor.
Can someone confirm the best way to deal with this, please? Can they be deleted, or should they be renamed, and then changed back after the software installation has completed?
Also, are there any other locations in the registry that need to be checked?
Many thanks
Mark