The working folder is a file-based storage that keeps operational information (configuration files of the product components, log files, and other data). Netwrix Auditor also caches some audit data in this folder for a short period (up to 30 days) prior to storing it to the Long-Term Archive or Audit database. By default, the working folder is located on the system drive at %PROGRAMDATA%\Netwrix Auditor.
In busy environments and during activity peaks, working folder size may grow significantly. To track the working folder capacity, use the Working Folder widget.
NOTE: If you need to change the working folder location, follow the instructions provided in this Knowledge Base article.