In short: Netwrix licensing through Forever Systems covers Netwrix 1Secure, a SaaS platform for data security posture management, identity risk and activity auditing; Netwrix Auditor for on-premises change auditing; and PingCastle Active Directory security assessments. 1Secure and most Auditor sources are licensed per user, and we handle setup, user changes and renewals.
What Netwrix does
Netwrix is a security software vendor headquartered in Frisco, Texas, that focuses on two things most breaches eventually touch: identities and data. Its tools answer the questions auditors, insurers and incident responders ask first. Who has access to what? Where is the sensitive data? What changed, who changed it and when?
For organisations that run on Microsoft, that means Active Directory, Microsoft Entra ID, Microsoft 365, Windows file servers and SQL Server. Netwrix finds risky configurations and excessive permissions, discovers and classifies sensitive files, records changes and access, and alerts on suspicious activity.
Netwrix sells a wide catalogue, from privileged access management to endpoint data loss prevention. On this site we supply the three products most UK small and mid-sized organisations ask us about: the cloud platform Netwrix 1Secure, the long-established on-premises Netwrix Auditor, and Netwrix PingCastle for Active Directory security assessments.
The Netwrix products we supply
| Product | What it does | Deployment | Licensed by |
|---|---|---|---|
| Netwrix 1Secure | Data security posture management (DSPM), identity risk assessment, activity auditing and alerting | SaaS hosted by Netwrix, with an agent for on-premises sources | Per identity (user) |
| Netwrix Auditor | Change and access auditing with compliance reports, plus optional data discovery and classification | Installed on your Windows server | Mainly per enabled user; some sources per server, device or processor |
| Netwrix PingCastle | Active Directory and Entra ID security assessment, risk scoring and remediation guidance | Windows tool; its checks also run inside 1Secure | Free Community edition for your own use; paid commercial and Enterprise licences |
If you are starting fresh, 1Secure is usually the best fit because there is no audit server or database to maintain. Netwrix's own Auditor material directs anyone wanting a cloud deployment to 1Secure. If you already run Netwrix Auditor on premises, we can renew and extend it, or plan a move.
How Netwrix licensing works
Netwrix licences are mostly counted by the people in your directory rather than by devices:
- 1Secure is licensed per identity (user). Netwrix sells it in Data, Identity and Complete editions, and service accounts can be kept out of the billable count by placing them in an Active Directory OU or Entra ID group that is excluded in the source settings.
- Netwrix Auditor counts enabled Active Directory users for most data sources. Disabled, deleted, group and computer accounts do not count, but service accounts do. Some sources use a different measure: network devices per device, Windows Server per user or per server, Oracle Database per processor licence, and Exchange by enabled user mailbox.
- PingCastle has a free Community edition that may only be used to audit your own environment and comes without support. Auditing other organisations needs a commercial licence, and the Enterprise edition is a separate paid product.
Prices depend on the product, user numbers, edition and term, so ask us for a quote and we will confirm the billing options available for your organisation.
Who Netwrix suits
Netwrix is a good fit when you need to prove what is happening in your Microsoft environment, not just protect it:
- organisations preparing for an audit, cyber insurance renewal or a framework such as UK GDPR or PCI DSS, who need reports showing who accessed and changed sensitive data
- IT teams who inherited an Active Directory built up over many years and want a prioritised list of what to fix
- businesses planning a Microsoft 365 Copilot rollout who want to find overshared files and excessive permissions before Copilot can surface them
- schools, charities and public sector bodies holding personal data on file shares and in SharePoint
It sits alongside, rather than replacing, your endpoint protection and MFA. If missing MFA is one of the findings, see identity, MFA and privileged access.
Buying Netwrix through Forever Systems
We set Netwrix up in your organisation's name and look after it from there.
- Scope: we count the users that will be licensed and identify the data sources you want covered: Active Directory, Entra ID, Exchange Online, SharePoint Online, file servers or SQL Server.
- Quote: we recommend 1Secure, Auditor or a PingCastle assessment, and the right term. Ask us for a quote.
- Deploy: we connect cloud sources, install the agent or Auditor server where on-premises sources are involved, and tune alerts so they mean something.
- Run: one invoice, with user changes and renewals handled for you. We can also review findings with you and carry out the fixes.
Microsoft 365 and Copilot licences themselves are handled by Forever Group's Microsoft licensing team. Compare Netwrix with other vendors on our vendors A to Z.
Explore Netwrix
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Netwrix licensed per user?
Mostly, yes. Netwrix 1Secure is licensed per identity, and Netwrix Auditor counts enabled Active Directory users for most data sources. Some Auditor sources are counted differently: network devices per device, Windows Server per user or per server, and Oracle Database per processor licence. We count your users before we quote so the licence matches your directory.
What is the difference between Netwrix 1Secure and Netwrix Auditor?
1Secure is a SaaS platform hosted by Netwrix, with an agent for on-premises sources. Netwrix Auditor is installed on your own Windows server and stores audit data in SQL Server databases. 1Secure adds data security posture management and PingCastle-based identity risk checks; Auditor covers a wider range of on-premises systems such as VMware, NAS storage, Oracle and network devices.
Can you renew our existing Netwrix Auditor licence?
Yes. Send us your current licence details or renewal notice and we will quote the renewal, check your enabled user count and talk through whether moving to 1Secure makes sense.
How is Netwrix billed through Forever Systems?
Billing options depend on the product. 1Secure and Auditor are both licensed per user and priced by user count, and PingCastle commercial licences are subscriptions. Tell us what you need covered and we will confirm the term, commitment and billing when we quote.
Do you sell Microsoft 365 or Copilot licences here?
No. Netwrix helps secure Microsoft 365 and prepare for Copilot, but the Microsoft subscriptions are handled by Forever Group's Microsoft licensing team.