From 7652bd24281a9fd80879c6de0f73dfa722058fb2 Mon Sep 17 00:00:00 2001 From: hilram7 Date: Tue, 28 Oct 2025 16:45:43 -0400 Subject: [PATCH 1/4] docs(kb): add 4 new Netwrix Access Analyzer KB articles for ExchangePS and SPAA/SPAC errors and warnings --- .../Error-invalid-local-SPAA-storage-version | 36 +++++++++ ...-WinRM-Shell-Client-Cannot-Process-Request | 0 ...variable-with-name-enablesearchonlysession | 0 .../SEEK-warning-DLPEX-Database-Not-Exist | 0 .../failed-to-initialize-task.md | 79 +++++++++++++++++++ 5 files changed, 115 insertions(+) create mode 100644 docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version create mode 100644 docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request create mode 100644 docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession create mode 100644 docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist create mode 100644 docs/kb/accessanalyzer/failed-to-initialize-task.md diff --git a/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version b/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version new file mode 100644 index 0000000000..79dd917905 --- /dev/null +++ b/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version @@ -0,0 +1,36 @@ +--- +title: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0" +sidebar_label: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0" +description: "Resolve the 'Invalid Local SPAA Storage Version' error in Netwrix Access Analyzer by running the required SPAA or SPSEEK System Scans before executing a SPAC System Scan." +keywords: [SPAA, SPAC, SPSEEK, InvalidStorageVersionException, Netwrix, Access Analyzer, system scan, storage version, error 11603] +products: [access-analyzer, enterprise-auditor] +knowledge_article_id: kA0Qk000000XXXXKAA +--- + +## Related Queries + +- "SPAC scan fails with storage version error." +- "Error: InvalidStorageVersionException Expected 11603." + +## Symptom + +When attempting to run a SPAC System Scan in Netwrix Access Analyzer (formerly Enterprise Auditor), the following error occurs: + +```text +Stealthbits.StealthAUDIT.DataCollectors.SPAA.Storage.InvalidStorageVersionException: Invalid local spaa storage version. Expected 11603 but found 0. +``` + +## Cause + +This error occurs when a SPAC System Scan is run *before* a SPAA System Scan or SPSEEK System Scan has been executed. +These scans are required to initialize and version the local SPAA storage. +If neither scan has been completed, the system reports an invalid version of `0`. + +## Resolution + +To resolve the issue: + +1. Run a **SPAA System Scan** or a **SPSEEK System Scan** +2. After the scan completes successfully, run the **SPAC System Scan** again. + +--- diff --git a/docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request b/docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request new file mode 100644 index 0000000000..e69de29bb2 diff --git a/docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession b/docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession new file mode 100644 index 0000000000..e69de29bb2 diff --git a/docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist b/docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist new file mode 100644 index 0000000000..e69de29bb2 diff --git a/docs/kb/accessanalyzer/failed-to-initialize-task.md b/docs/kb/accessanalyzer/failed-to-initialize-task.md new file mode 100644 index 0000000000..d81938f179 --- /dev/null +++ b/docs/kb/accessanalyzer/failed-to-initialize-task.md @@ -0,0 +1,79 @@ +--- +description: > + When accessing the Scheduled Actions section in Netwrix Access Analyzer, the console may fail to load with the error "Sequence contains more than one matching element." This occurs when duplicate job files exist in the Jobs directory. Learn how to identify and resolve this error. +keywords: + - Netwrix Access Analyzer + - NAA + - Scheduled Actions + - SAJOB error + - duplicate job file + - jobs directory + - task initialization + - failed to get tasks + - console error + - backup job conflict +products: + - access-analyzer +sidebar_label: 'Error: Failed to Initialize Task SAJOB – Sequence Conflict' +title: 'Error: Failed to Initialize Task SAJOB – Sequence Contains More Than One Matching Element' +knowledge_article_id: kA0Qk000000XXXXKAA +--- + +# Error: Failed to Initialize Task SAJOB – Sequence Contains More Than One Matching Element + +## Related Queries + +- “Netwrix Access Analyzer Scheduled Actions not loading” +- “Failed to initialize task SAJOB… sequence contains more than one matching element” +- “Duplicate job name causing console error” +- “NAA job loading issue” + +## Symptom + +When accessing the **Scheduled Actions** section in **Netwrix Access Analyzer (NAA)**, the following error appears: + +```text +Failed to get tasks. Error: Failed to initialize task SAJOB~JobName~{GUID}.job. +Error: Sequence contains more than one matching element +``` + +## Cause + +Netwrix Access Analyzer scans the entire `Jobs` directory—including all subfolders—for job files. Each job must be uniquely identified by the system. + +This error occurs when **multiple copies of the same job file** exist within the `Jobs` directory tree, often because someone copied job folders into a subfolder such as `Backup` for safekeeping. + +Renaming the folder (for example, `BU_Backup`) does **not** resolve the issue. All subfolders under `Jobs` are scanned. + +> Copying jobs between valid group folders is supported. For example: +> - `1-FSAA_SystemScan` +> - `1-FSAA_SystemScan1` +> +> These are fine because they are treated as separate jobs. + +## Resolution + +### Step 1: Search for Duplicate Job Names + +1. Open **File Explorer**. +2. Navigate to `%SAInstall%\Jobs`. +3. Use the **Search** bar to search for the job name listed in the error (for example, `AD Users`). +4. Look for the **same job name appearing in more than one folder**, especially in folders such as `Backup`, `Archive`, or other custom subfolders inside `Jobs`. + +> If the same job appears in multiple locations with the **exact same name**, that is likely the cause of the conflict. + +### Step 2: Remove or Move the Extra Copy + +- **Move any backup copies** outside of the `Jobs` directory (for example, to `C:\JobBackups`). +- Or, if no longer needed, **delete the duplicate copy**. + +### Step 3: Relaunch the Console + +After cleaning up the duplicates: + +- Restart **Netwrix Access Analyzer**. +- The **Scheduled Actions** view should now load without errors. + +## Best Practice + +> **Do not store backup jobs inside the `Jobs` directory.** Always move backups to a folder outside of it (for example, `C:\JobBackups`) to avoid conflicts. From 608579a80baf30221a40767a4e1bff4f13964852 Mon Sep 17 00:00:00 2001 From: hilram7 Date: Tue, 28 Oct 2025 17:09:09 -0400 Subject: [PATCH 2/4] docs(kb): add 4 new Netwrix Access Analyzer KB articles for ExchangePS and SPAA/SPAC errors and warnings --- .../failed-to-initialize-task.md | 79 ------------------- 1 file changed, 79 deletions(-) delete mode 100644 docs/kb/accessanalyzer/failed-to-initialize-task.md diff --git a/docs/kb/accessanalyzer/failed-to-initialize-task.md b/docs/kb/accessanalyzer/failed-to-initialize-task.md deleted file mode 100644 index d81938f179..0000000000 --- a/docs/kb/accessanalyzer/failed-to-initialize-task.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -description: > - When accessing the Scheduled Actions section in Netwrix Access Analyzer, the console may fail to load with the error "Sequence contains more than one matching element." This occurs when duplicate job files exist in the Jobs directory. Learn how to identify and resolve this error. -keywords: - - Netwrix Access Analyzer - - NAA - - Scheduled Actions - - SAJOB error - - duplicate job file - - jobs directory - - task initialization - - failed to get tasks - - console error - - backup job conflict -products: - - access-analyzer -sidebar_label: 'Error: Failed to Initialize Task SAJOB – Sequence Conflict' -title: 'Error: Failed to Initialize Task SAJOB – Sequence Contains More Than One Matching Element' -knowledge_article_id: kA0Qk000000XXXXKAA ---- - -# Error: Failed to Initialize Task SAJOB – Sequence Contains More Than One Matching Element - -## Related Queries - -- “Netwrix Access Analyzer Scheduled Actions not loading” -- “Failed to initialize task SAJOB… sequence contains more than one matching element” -- “Duplicate job name causing console error” -- “NAA job loading issue” - -## Symptom - -When accessing the **Scheduled Actions** section in **Netwrix Access Analyzer (NAA)**, the following error appears: - -```text -Failed to get tasks. Error: Failed to initialize task SAJOB~JobName~{GUID}.job. -Error: Sequence contains more than one matching element -``` - -## Cause - -Netwrix Access Analyzer scans the entire `Jobs` directory—including all subfolders—for job files. Each job must be uniquely identified by the system. - -This error occurs when **multiple copies of the same job file** exist within the `Jobs` directory tree, often because someone copied job folders into a subfolder such as `Backup` for safekeeping. - -Renaming the folder (for example, `BU_Backup`) does **not** resolve the issue. All subfolders under `Jobs` are scanned. - -> Copying jobs between valid group folders is supported. For example: -> - `1-FSAA_SystemScan` -> - `1-FSAA_SystemScan1` -> -> These are fine because they are treated as separate jobs. - -## Resolution - -### Step 1: Search for Duplicate Job Names - -1. Open **File Explorer**. -2. Navigate to `%SAInstall%\Jobs`. -3. Use the **Search** bar to search for the job name listed in the error (for example, `AD Users`). -4. Look for the **same job name appearing in more than one folder**, especially in folders such as `Backup`, `Archive`, or other custom subfolders inside `Jobs`. - -> If the same job appears in multiple locations with the **exact same name**, that is likely the cause of the conflict. - -### Step 2: Remove or Move the Extra Copy - -- **Move any backup copies** outside of the `Jobs` directory (for example, to `C:\JobBackups`). -- Or, if no longer needed, **delete the duplicate copy**. - -### Step 3: Relaunch the Console - -After cleaning up the duplicates: - -- Restart **Netwrix Access Analyzer**. -- The **Scheduled Actions** view should now load without errors. - -## Best Practice - -> **Do not store backup jobs inside the `Jobs` directory.** Always move backups to a folder outside of it (for example, `C:\JobBackups`) to avoid conflicts. From 5cd71cbf7fb791de2e0090424997c9a6354d0d89 Mon Sep 17 00:00:00 2001 From: hilram7 Date: Wed, 29 Oct 2025 16:03:56 -0400 Subject: [PATCH 3/4] fix: add content to KB articles that were previously empty --- .../Error-invalid-local-SPAA-storage-version | 36 ------------------- ...-WinRM-Shell-Client-Cannot-Process-Request | 0 ...variable-with-name-enablesearchonlysession | 0 .../SEEK-warning-DLPEX-Database-Not-Exist | 0 4 files changed, 36 deletions(-) delete mode 100644 docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version delete mode 100644 docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request delete mode 100644 docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession delete mode 100644 docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist diff --git a/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version b/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version deleted file mode 100644 index 79dd917905..0000000000 --- a/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0" -sidebar_label: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0" -description: "Resolve the 'Invalid Local SPAA Storage Version' error in Netwrix Access Analyzer by running the required SPAA or SPSEEK System Scans before executing a SPAC System Scan." -keywords: [SPAA, SPAC, SPSEEK, InvalidStorageVersionException, Netwrix, Access Analyzer, system scan, storage version, error 11603] -products: [access-analyzer, enterprise-auditor] -knowledge_article_id: kA0Qk000000XXXXKAA ---- - -## Related Queries - -- "SPAC scan fails with storage version error." -- "Error: InvalidStorageVersionException Expected 11603." - -## Symptom - -When attempting to run a SPAC System Scan in Netwrix Access Analyzer (formerly Enterprise Auditor), the following error occurs: - -```text -Stealthbits.StealthAUDIT.DataCollectors.SPAA.Storage.InvalidStorageVersionException: Invalid local spaa storage version. Expected 11603 but found 0. -``` - -## Cause - -This error occurs when a SPAC System Scan is run *before* a SPAA System Scan or SPSEEK System Scan has been executed. -These scans are required to initialize and version the local SPAA storage. -If neither scan has been completed, the system reports an invalid version of `0`. - -## Resolution - -To resolve the issue: - -1. Run a **SPAA System Scan** or a **SPSEEK System Scan** -2. After the scan completes successfully, run the **SPAC System Scan** again. - ---- diff --git a/docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request b/docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession b/docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist b/docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist deleted file mode 100644 index e69de29bb2..0000000000 From 78d52eddc040761355b9b8420836967beb7f6bbd Mon Sep 17 00:00:00 2001 From: hilram7 Date: Wed, 29 Oct 2025 16:11:44 -0400 Subject: [PATCH 4/4] docs(kb): add 4 new Access Analyzer KB articles with proper .md extensions --- ...rror-invalid-local-SPAA-storage-version.md | 36 ++++++ ...nRM-Shell-Client-Cannot-Process-Request.md | 115 ++++++++++++++++++ ...iable-with-name-enablesearchonlysession.md | 45 +++++++ .../SEEK-warning-DLPEX-Database-Not-Exist.md | 57 +++++++++ 4 files changed, 253 insertions(+) create mode 100644 docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version.md create mode 100644 docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request.md create mode 100644 docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession.md create mode 100644 docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist.md diff --git a/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version.md b/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version.md new file mode 100644 index 0000000000..59ff8a9d68 --- /dev/null +++ b/docs/kb/accessanalyzer/Error-invalid-local-SPAA-storage-version.md @@ -0,0 +1,36 @@ +--- +title: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0" +sidebar_label: "Error: Invalid Local SPAA Storage Version. Expected 11603 but Found 0" +description: "Resolve the 'Invalid Local SPAA Storage Version' error in Netwrix Access Analyzer by running the required SPAA or SPSEEK System Scans before executing a SPAC System Scan." +keywords: [SPAA, SPAC, SPSEEK, InvalidStorageVersionException, Netwrix, Access Analyzer, system scan, storage version, error 11603] +products: [access-analyzer, enterprise-auditor] +knowledge_article_id: ka0Qk000000GLq5IAG +--- + +## Related Queries + +- "SPAC scan fails with storage version error." +- "Error: InvalidStorageVersionException Expected 11603." + +## Symptom + +When attempting to run a SPAC System Scan in Netwrix Access Analyzer (formerly Enterprise Auditor), the following error occurs: + +```text +Stealthbits.StealthAUDIT.DataCollectors.SPAA.Storage.InvalidStorageVersionException: Invalid local spaa storage version. Expected 11603 but found 0. +``` + +## Cause + +This error occurs when a SPAC System Scan is run *before* a SPAA System Scan or SPSEEK System Scan has been executed. +These scans are required to initialize and version the local SPAA storage. +If neither scan has been completed, the system reports an invalid version of `0`. + +## Resolution + +To resolve the issue: + +1. Run a **SPAA System Scan** or a **SPSEEK System Scan** +2. After the scan completes successfully, run the **SPAC System Scan** again. + +--- diff --git a/docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request.md b/docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request.md new file mode 100644 index 0000000000..e84246257b --- /dev/null +++ b/docs/kb/accessanalyzer/ExchangePS-Error-WinRM-Shell-Client-Cannot-Process-Request.md @@ -0,0 +1,115 @@ +--- +title: "ExchangePS Error: The WinRM Shell Client Cannot Process the Request" +sidebar_label: "ExchangePS Error: The WinRM Shell Client Cannot Process the Request" +description: "Learn how to resolve the 'WinRM Shell client cannot process the request' error in ExchangePS data collector jobs by updating the PackageManagement and ExchangeOnlineManagement PowerShell modules." +keywords: [ExchangePS, WinRM, New-ExoPSSession, PowerShell, ExchangeOnlineManagement, PackageManagement, StealthAUDIT, data collector, Office 365, remote session] +products: [enterprise-auditor, access-analyzer] +knowledge_article_id: ka0Qk000000GS0LIAW +--- + +## Related Queries + +- "ExchangePS shell handle is not valid." +- "New-ExoPSSession fails with WinRM Shell client error." +- "ExchangeOnlineManagement 2.0.5 error with StealthAUDIT job." +- "Stealthbits Exchange data collector fails to connect." + +## Symptom + +Jobs that use the ExchangePS data collector fail with the following error: + +```text +PowerShell error: System.Exception: New-ExoPSSession : Processing data from remote server outlook.office365.com failed with the following error message: The WinRM Shell client cannot process the request. The shell handle passed to the WSMan Shell function is not valid. The shell handle is valid only when WSManCreateShell function completes successfully. +``` + +## Cause + +This issue occurs when one or both of the following PowerShell modules are outdated or incompatible: + +- `PackageManagement` module version is earlier than `1.0.0.1` +- `ExchangeOnlineManagement` module version is `2.0.5` or earlier + +These versions are known to cause instability with remote sessions using `New-ExoPSSession`. + +## Resolution + +### Step 1: Verify Installed Module Versions + +Open a PowerShell session and run: + +```powershell +Get-Module -ListAvailable PackageManagement +Get-Module -ListAvailable ExchangeOnlineManagement +``` + +### Step 2: Update Modules Using PowerShell (Preferred Method) + +- Update `PackageManagement` module: + ```powershell + Install-Module PackageManagement -Force -Scope AllUsers + ``` + +- Update `ExchangeOnlineManagement` module: + ```powershell + Install-Module ExchangeOnlineManagement -Force -Scope AllUsers + ``` + +> **IMPORTANT:** +> Close and reopen all PowerShell sessions after updating modules. + +### Step 3: Manual Update (If Unable to Install via PowerShell) + +If the environment prevents direct downloads from PowerShell, update the modules manually. + +#### Download the `.nupkg` Files + +1. Visit the following URLs: + - [PackageManagement 1.4.8.1](https://www.powershellgallery.com/packages/PackageManagement/1.4.8.1) + - [ExchangeOnlineManagement 3.9.1-Preview1](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.9.1-Preview1) + +2. Download the `.nupkg` file for each required version. + +#### Convert `.nupkg` to ZIP and Extract + +1. Rename the downloaded `.nupkg` file to `.zip` + Example: `PackageManagement.1.4.8.1.zip` +2. Unblock the ZIP file using one of the following methods: + - In File Explorer, right-click **Properties** > **Unblock**. + - Or run: + ```powershell + Unblock-File .\PackageManagement.1.4.8.1.zip + ``` +3. Extract the contents of each ZIP file. + +#### Rename the Extracted Folder + +- Rename `PackageManagement.1.4.8.1` to `1.4.8.1` +- Rename `ExchangeOnlineManagement.3.4.0` to `3.4.0` (or the version you downloaded) + +#### Move to PowerShell Modules Directory + +Place the renamed folders in the correct directories: + +- For PackageManagement: + `C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.4.8.1` +- For ExchangeOnlineManagement: + `C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.4.0` + +### Step 4: Confirm Module Versions + +Re-run the version checks: + +```powershell +Get-Module -ListAvailable PackageManagement +Get-Module -ListAvailable ExchangeOnlineManagement +``` + +Ensure that: + +- `PackageManagement` is version **1.4.8.1** or newer +- `ExchangeOnlineManagement` is version **2.0.6** or newer + +> **IMPORTANT:** +> Rerun jobs that use the ExchangePS data collector to confirm that the error message no longer appears. + +--- diff --git a/docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession.md b/docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession.md new file mode 100644 index 0000000000..9cc9e3dd40 --- /dev/null +++ b/docs/kb/accessanalyzer/ExchangePS-error-cannot-find-variable-with-name-enablesearchonlysession.md @@ -0,0 +1,45 @@ +--- +title: "ExchangePS Error: Cannot Find a Variable With the Name 'EnableSearchOnlySession'" +sidebar_label: "ExchangePS Error: Cannot Find a Variable With the Name 'EnableSearchOnlySession'" +description: "Resolve the ExchangePS data collector error 'Cannot find a variable with the name EnableSearchOnlySession' by configuring the job to use an explicit connection profile with valid Exchange credentials." +keywords: [ExchangePS, EnableSearchOnlySession, PowerShell, StealthAUDIT, EX_MBRights, EX_SendAs, data collector, connection profile, Exchange, credentials] +products: [enterprise-auditor, access-analyzer] +knowledge_article_id: ka0Qk000000GCtFIAW +--- + +## Related Queries + +- "Receiving Get-Variable 'EnableSearchOnlySession' error on EX_MBRights job." +- "EX_SendAs job failed to inherit credentials." +- "Cannot find a variable with the name 'EnableSearchOnlySession'." + +## Symptom + +When running Exchange jobs using the ExchangePS data collector, the following error appears: + +```text +Get-Variable 'EnableSearchOnlySession' error: Cannot find a variable with the name 'EnableSearchOnlySession'. +``` + +## Cause + +This issue occurs when the ExchangePS data collector fails to inherit the correct session credentials. +Without proper credentials, the session does not initialize the expected variables, including `EnableSearchOnlySession`. + +## Resolution + +To resolve the issue, configure the job to use an explicit connection profile. +This ensures the session uses the appropriate credentials, allowing the necessary variables to load correctly. + +1. Right-click the affected job. +2. Select **Properties**. +3. Go to the **Connection** tab. +4. Choose the bottom radio button to specify a custom connection profile. +5. Select the connection profile that contains valid Exchange credentials. + +> **NOTE:** +> Navigate to **Settings > Connection** to verify which credentials are valid for Exchange. + +6. Click **OK** to save the changes. + +--- diff --git a/docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist.md b/docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist.md new file mode 100644 index 0000000000..a18fb91622 --- /dev/null +++ b/docs/kb/accessanalyzer/SEEK-warning-DLPEX-Database-Not-Exist.md @@ -0,0 +1,57 @@ +--- +title: "SEEK Bulk Import Warning: DLPEX Database Does Not Exist" +sidebar_label: "SEEK Bulk Import Warning: DLPEX Database Does Not Exist" +description: "Learn why the SEEK Bulk Import warning 'DLPEX database does not exist' appears and how to resolve it by verifying SEEK Scan completion and DLPEX database availability." +keywords: [SEEK, DLPEX, T2 database, bulk import, SEEK Scan, data classification, import warning, Netwrix, scan failure, sensitive data] +products: [enterprise-auditor, access-analyzer] +knowledge_article_id: ka0Qk000000GKnZIAW +--- + +## Related Queries + +- "SEEK Bulk Import error DLPEX database does not exist." +- "No sensitive data to import SEEK." +- "SEEK import warning T2 not found." +- "SEEK or SDD scan ran, but import fails." + +## Symptom + +When running a SEEK Bulk Import, the following warning is displayed: + +```text +WARNING | DLPEX database does not exist, there is no data to import. +``` + +Despite the warning, the import process completes without any imported data. + +## Cause + +This warning indicates that the system attempted to import sensitive data (T2) from a host that does not have the required DLPEX database. +This can occur due to one of the following reasons: + +- **Unscanned hosts in the import list:** One or more hosts included in the bulk import were not scanned using SEEK Scan, and therefore, no DLPEX (T2) database was created. +- **Scan failures:** The host experienced a catastrophic error during the SEEK Scan, which prevented the creation of the sensitive data (T2) database. + +> **NOTE:** +> If the import runs and simply finds no new data (but the database exists), no warning is shown and the import completes successfully. +> The warning only appears if the expected DLPEX database is missing entirely. + +## Resolution + +To resolve this warning, follow these steps: + +1. **Review the host list** + - Confirm that all hosts listed in the SEEK Bulk Import are being scanned via SEEK Scan. + - Remove any hosts from the list that are not currently scanned. + +2. **Check scan results** + - Investigate SEEK Scan logs for any failed scans. + - Look for errors indicating that the DLPEX or T2 database could not be created. + +3. **Rerun the scan** + - Rerun the SEEK Scan on the affected hosts to generate the T2 database. + +4. **Retry the bulk import** + - Once scans have completed successfully and the DLPEX databases exist, rerun the SEEK Bulk Import. + +---