In short: Netwrix Auditor is on-premises auditing software that records who accessed or changed what, when and where across Active Directory, Entra ID, Microsoft 365, file servers, SQL Server, VMware and more. Most data sources are licensed per enabled Active Directory user, and it can be combined with Netwrix Data Classification.
What Netwrix Auditor is
Netwrix Auditor is Netwrix's long-standing auditing platform. You install it on a Windows server in your own environment and it collects audit data from the systems you point it at, then gives you a searchable record of activity, scheduled and on-demand reports, and real-time alerts.
It answers the classic audit questions (who changed this group membership, who opened that folder, who deleted the mailbox) and adds a risk assessment dashboard that flags problems such as excessive permissions, inactive accounts and accounts with admin rights. Behaviour anomaly detection scores users by risk so you can prioritise investigations, and an optional Access Reviews module lets data owners approve permissions or request changes. Auditor can also restore deleted or modified Active Directory objects without restarting a domain controller.
Netwrix provides predefined reports mapped to frameworks including GDPR, PCI DSS, HIPAA, SOX and CMMC, plus downloadable mappings for NIS2 and ISO/IEC 27001. UK organisations typically use them as evidence for UK GDPR, PCI DSS and ISO 27001 audits.
Supported systems
| Area | Data sources |
|---|---|
| Identity | Active Directory, Microsoft Entra ID |
| Microsoft collaboration | Exchange, Exchange Online, SharePoint, SharePoint Online, OneDrive, Teams |
| File storage | Windows file servers, NetApp, Dell storage, Nutanix Files, Azure Files, Qumulo, Synology |
| Databases | SQL Server, Oracle Database |
| Infrastructure | Windows Server, VMware vSphere, network devices |
That breadth of on-premises coverage is the main reason to choose Auditor over Netwrix 1Secure, which covers Microsoft 365, Active Directory, Windows Server, Windows file servers and SQL Server.
How Netwrix Auditor is licensed
Each data source Auditor audits is linked to a licence, and you can see the counts under Settings, Licenses in the console.
- Enabled Active Directory users are the measure for most sources, including Active Directory, Access Reviews, SQL Server, VMware, Windows file servers and NAS storage. Disabled, deleted, group and computer accounts do not count; service accounts do.
- Enabled Entra ID users are the measure for Entra ID and Teams (guest users are not counted), and enabled user mailboxes for Exchange, where shared and resource mailboxes do not count.
- Network devices are counted per device, Windows Server either per enabled user or per server, and Oracle Database per Oracle processor licence.
We supply Auditor priced in bands by user count, either on its own or with Data Classification:
| Option | What it adds |
|---|---|
| Netwrix Auditor | Change and access auditing, alerts, risk assessments and compliance reports |
| Netwrix Auditor plus Discovery and Classification | Adds Netwrix Data Classification to find and tag sensitive data, so reports can focus on who accessed it |
Netwrix provides a script that counts enabled user accounts in a domain, and another for Microsoft 365 mailboxes, which we use before quoting. Ask us for a quote for your user count and term.
Requirements and deployment
Auditor runs on a Windows server you provide and stores recent activity in SQL Server audit databases (180 days by default) for searching, reporting and alerting. Long-term history goes to a compressed, file-based Long-Term Archive, kept for 120 months by default; both periods can be changed, and older data can be imported from the archive into an investigation database when you need it. Netwrix recommends SQL Server Standard or Enterprise for production, with SQL Server Express suitable only for evaluation or small environments, and reports need SQL Server Reporting Services.
Installing Auditor itself is quick. Most of the work is in planning which sources to monitor, enabling the right audit policies on each and tuning reports and alerts so they are useful.
Who Auditor suits
Auditor suits organisations with a substantial on-premises estate (VMware, NetApp or other NAS, Oracle, network devices) that need one place to audit all of it, and those who must keep audit data inside their own network. It is also the obvious choice if you already run it and simply need to renew or add users.
If your estate is now mostly Microsoft 365 and you would rather not maintain an audit server, look at Netwrix 1Secure.
How we help
We renew existing Auditor licences, true-up your user count, add Data Classification and upgrade to current versions. For new installs we size the server and SQL Server, configure audit policies on each source and set up reports and alerts for your auditors. If moving to 1Secure makes more sense, we plan the switch so you keep the history you need. Ask us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How is Netwrix Auditor licensed?
By data source, mostly per enabled Active Directory user. Entra ID and Teams count enabled Entra ID users, Exchange counts enabled user mailboxes, network devices are counted per device, and Oracle Database per processor licence. Disabled, deleted and computer accounts do not count, but service accounts do.
What is Netwrix Data Classification?
It finds and classifies sensitive data, such as personal or payment data, across your file stores and other repositories. Combined with Auditor, it lets you see who has access to sensitive data and what they did with it.
Do I need SQL Server for Netwrix Auditor?
Yes. Auditor keeps recent activity in SQL Server audit databases for searching and reporting, and reports use SQL Server Reporting Services. Netwrix recommends Standard or Enterprise edition for production; Express is for evaluation or small environments.
Should I move from Netwrix Auditor to 1Secure?
If most of what you audit is Microsoft 365, Active Directory and file servers, 1Secure removes the server and database you maintain today. If you audit VMware, network devices or non-Windows storage, Auditor still covers more. We can review your sources and advise.