Go Up
You are here: AdministrationAdditional ConfigurationFine-tune Netwrix Auditor with Registry KeysGroup Policy Monitoring

Registry Keys for Monitoring Group Policy

Review the basic registry keys that you may need to configure for monitoring Group Policy with Netwrix Auditor. Navigate to Start Run and type "regedit".

Registry key (REG_DWORD type) Description / Value
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter

CleanAutoBackupLogs

Defines the retention period for the security log backups:

  • 0—Backups are never deleted from Domain controllers
  • [X]— Backups are deleted after [X] hours

GPOBackup

Defines whether to backup GPOs during data collection:

  • 0—No
  • 1—Yes

GPOBackupDays

Defines the backup frequency:

  • 0—Backup always
  • X—Once in X days

NOTE: GPOBackup must be set to "1".

IgnoreAuditCheckResultError

Defines whether audit check errors should be displayed in the Activity Summary footer:

  • 0—Display errors
  • 1—Do not display errors

IgnoreRootDCErrors

Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer:

  • 0—Display errors
  • 1—Do not display errors

LogonResolveOptions

Defines what will be shown in the Workstation field:

  • 2—MAC address
  • 4—FQDN or IP address (set by default)
  • 6—Both

ShortEmailSubjects

Defines whether to contract the email subjects (e.g., Netwrix Group Policy Change Reporter: Summary Report – GPCR Report):

  • 0—No
  • 1—Yes

ProcessBackupLogs

Defines whether to process security log backups:

  • 0—No
  • 1—Yes

NOTE: Even if this key is set to "0", the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key.

ShowReportFooter

Defines whether to display the footer in the Activity Summary email:

  • 0—No
  • 1—Yes

ShowReportGeneratorServer

Defines whether to display the report generation server in the Activity Summary footer:

  • 0—No
  • 1—Yes

ShowSummaryInFooter

Defines whether to display the summary in the Activity Summary footer:

  • 0—No
  • 1—Yes

ShowSummaryInHeader

Defines whether to display the summary in the Activity Summary header:

  • 0—No
  • 1—Yes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter\<monitoring plan name>

CollectLogsMaxThreads

Defines the number of Domain Controllers to simultaneously start log collection on.

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\ AD Change Reporter\<monitoring plan name>\Database settings

SessionImportDays

Defines the frequency of a full snapshot upload:

  • X—Once in X days
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Management Console\Database settings

overwrite_datasource

Defines whether to overwrite the database connection settings (stored in the reports data source) if they differ from the SQL server settings specified when configuring the monitoring plan:

  • 0—No
  • 1—Yes

SqlOperationTimeout

Defines the timeout for executing SQL queries such as data selection, insertion or deletion (in seconds).

timeout

Defines the Audit Database connection timeout (in seconds).

Go Up