Long-Term Archive

The Long-Term Archive is configured by default, irrespective of your subscription plan and settings you specified when configuring a monitoring plan. To review and update your Long-Term Archive settings, navigate to Settings Long-Term Archive and click Modify.

Option Description

Long-Term Archive settings

Write audit data to

Specify the path to a local or shared folder where your audit data will be stored. By default, it is set to "C:\ProgramData\Netwrix Auditor\Data".

By default, the LocalSystem account is used to write data to the local-based Long-Term Archive and computer account is used for the file share-based storage.

Subscriptions created in the Netwrix Auditor client are uploaded to file servers under the Long-Term Archive service account as well.

NOTE: It is not recommended to store your Long-Term Archive on a system disk. If you want to move the Long-Term Archive to another location, refer to the following Netwrix Knowledge base article: How to move Long-Term Archive to a new location. Additional procedures are required if you upgraded Netwrix Auditor from 8.0. See the article for details.

Keep audit data for (in months)

Specify how long data will be stored. By default, it is set to 120 months.

Data will be deleted automatically when its retention period is over. If the retention period is set to 0, data will be automatically stored for the last 4 data collections for most of the data sources (event if the retention period is set to 0 data on SQL Server, file servers and Windows Server changes will be stored for the last 2 data collections, and 7 data collections for user activity).

Use custom credentials (for the file share-based Long-Term Archive only)

Select the checkbox and provide user name and password for the Long-Term Archive service account.

NOTE: You can specify a custom account only for the Long-Term Archive stored on a file share.

The custom Long-Term Archive service account can be granted the following rights and permissions:

  • Advanced permissions on the folder where the Long-Term Archive is stored:
    • List folder / read data
    • Read attributes
    • Read extended attributes
    • Create files / write data
    • Create folders / append data
    • Write attributes
    • Write extended attributes
    • Delete subfolders and files
    • Read permissions
  • On the file shares where report subscriptions are saved:

    • Change share permission
    • Create files / write data folder permission

    NOTE: Subscriptions created in the Netwrix Auditor client are uploaded to file servers under the Long-Term Archive service account as well.

Session recording settings

Configure custom location of session recordings

Default location for storing session recordings is set to "\\<NetwrixAuditorServerName>\Netwrix_UAVR$". However, storing extra files on Netwrix Auditor server may produce additional load on it, so consider using this option to specify another location where session recordings will be stored.

Enter UNC path to shared folder:

Specify UNC path to the shared folder where user session video recordings will be stored. You can use server name or IP address, for example:


NOTE: Using a local folder for that purpose is not recommended, as storing extra files on Netwrix Auditor server will produce additional load on it.

Make sure the specified shared folder has enough capacity to store the video files.

Retention period for the video files can be adjusted in the related monitoring plan settings (targeted at User Activity data source); default retention is 7 days. See User Activity for details.

NOTE: After you specify and save settings for session recordings, it is recommended that you leave them unchanged. Otherwise — if you change the storage location while using Netwrix Auditor for User Activity — please be aware of possible data loss, as Netwrix Auditor will not automatically move session recordings to a new location.

User name / Password

Provide user name and password for the account that will be used to store session recordings to the specified shared folder.

Make sure the account has at least Write permission for that folder.

NOTE: Netwrix Auditor informs you if you are running out of space on a system disk where the Long-Term Archive is stored by default. You will see events in the Netwrix Auditor System Health log once the free disk space starts approaching minimum level. When the free disk space is less than 3 GB, the Netwrix services responsible for audit data collection will be stopped.