Jump to content


Unable to Audit File Server (Event ID: 6128-6131)

  • Please log in to reply
1 reply to this topic

#1 rars1



  • Members
  • Pip
  • 1 posts

Posted 09 August 2018 - 07:52 PM

Hello, I'm Rodrigo from Chile, please your help:


I have a 2008 R2 SP1 Fileserver, works correctly time ago, but now the server not do not show the users who make changes in the shared folders.

The Events ID are 6128:



And the 6131.





Time ago, this works fine, but not now.

- The user who make the audit, is local administrator of the machine, and AD Administrator.

- The Server service is OK.

- The Netwrix has the last version (9.6).

- The Netwrix KB do not have this Events ID.


Please help.




#2 jeffb


    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 10 August 2018 - 02:33 PM



Is this Netwrix Auditor for Windows File Servers?  If so, you are welcome to submit a support case at https://www.netwrix.com/support.html.  It would be easier and more efficient to go this route if you have valid support/maintenance.  If you do not, let me know and we will attempt to help here on the forums.



0 user(s) are reading this topic

0 members, guests, anonymous users