From 7cf00b0594ef32761dd000c83770e3cacfb3fc43 Mon Sep 17 00:00:00 2001
From: hilram7 <212961752+hilram7@users.noreply.github.com>
Date: Mon, 8 Jun 2026 14:58:47 -0400
Subject: [PATCH 1/7] feat(kb): add 20 Change Tracker KB articles (easy batch
 1)

Adds configuration-and-setup and troubleshooting-and-errors articles
for Change Tracker. Fixes applied: keywords expanded to 8-12, article
structure aligned to KB standards (## Instructions, ## Symptom, H3
subsections), admonitions converted to blockquote format, two titles
corrected, passive voice and wordiness resolved, PCI-DSS acronym defined.
---
 ...s-exclusions-for-netwrix-change-tracker.md | 48 +++++++++++
 ...onfigure-fast-in-netwrix-change-tracker.md | 40 ++++++++++
 ...from-the-events-page-to-csv-pdf-or-xlsx.md | 40 ++++++++++
 .../how-to-export-more-than-50k-events.md     | 51 ++++++++++++
 ...ster-a-deleted-device-on-change-tracker.md | 41 ++++++++++
 ...aseline-events-after-the-agent-restarts.md | 42 ++++++++++
 ...integration-with-netwrix-change-tracker.md | 47 +++++++++++
 ...acker-recreating-deleted-default-groups.md | 42 ++++++++++
 ...nge-tracker-agent-via-powershell-script.md | 46 +++++++++++
 .../in-transit-and-at-rest-data-encryption.md | 43 ++++++++++
 .../resubmit-a-group-of-unplanned-changes.md  | 44 ++++++++++
 ...a-change-tracker-user-or-agent-password.md | 45 +++++++++++
 ...acker-agent-does-not-run-on-rhel-8-or-9.md | 80 +++++++++++++++++++
 ...e-to-access-change-tracker-login-screen.md | 49 ++++++++++++
 ...process-error-in-netwrix-change-tracker.md | 46 +++++++++++
 ...the-requested-event-counts-summary-size.md | 48 +++++++++++
 .../pages-in-report-exceed-250-error.md       | 52 ++++++++++++
 ...s-taking-up-large-amounts-of-disk-space.md | 46 +++++++++++
 ...system-error-when-running-event-queries.md | 50 ++++++++++++
 .../unable-to-upload-agent-update-files.md    | 76 ++++++++++++++++++
 20 files changed, 976 insertions(+)
 create mode 100644 docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/configure-fast-in-netwrix-change-tracker.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/how-to-export-more-than-50k-events.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/how-to-re-register-a-deleted-device-on-change-tracker.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/how-to-retrieve-baseline-events-after-the-agent-restarts.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/how-to-setup-siem-integration-with-netwrix-change-tracker.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/how-to-stop-change-tracker-recreating-deleted-default-groups.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/how-to-uninstall-change-tracker-agent-via-powershell-script.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/resubmit-a-group-of-unplanned-changes.md
 create mode 100644 docs/kb/changetracker/configuration-and-setup/what-special-characters-can-be-used-in-a-change-tracker-user-or-agent-password.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/change-tracker-agent-does-not-run-on-rhel-8-or-9.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/how-to-fix-error-the-requested-event-counts-summary-size.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/redis-qfork-dat-files-taking-up-large-amounts-of-disk-space.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/system-error-when-running-event-queries.md
 create mode 100644 docs/kb/changetracker/troubleshooting-and-errors/unable-to-upload-agent-update-files.md

diff --git a/docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md
new file mode 100644
index 0000000000..89541f5544
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md
@@ -0,0 +1,48 @@
+---
+description: >-
+  Antivirus and endpoint detection and response (EDR) exclusions required for
+  Netwrix Change Tracker agents and Hub to avoid performance degradation.
+keywords:
+  - antivirus exclusions
+  - EDR exclusions
+  - agents
+  - Hub
+  - MongoDB
+  - performance
+  - Gen7AgentCore
+  - nntgen7agentcore
+  - w3wp.exe
+  - mongod.exe
+  - AV exclusions
+  - endpoint protection
+products:
+  - change-tracker
+sidebar_label: Antivirus Exclusions
+tags:
+  - kb
+  - configuration-and-setup
+title: Antivirus Exclusions for Netwrix Change Tracker
+knowledge_article_id: ""
+---
+
+# Antivirus Exclusions for Netwrix Change Tracker
+
+## Overview
+
+Antivirus (AV) and endpoint detection and response (EDR) solutions may negatively affect Netwrix Change Tracker performance. Add the following exclusions to avoid potential performance degradation.
+
+## Instructions
+
+### Exclusions for Netwrix Change Tracker Agents
+
+| Name/Platform | Service | Process | Folder |
+|---|---|---|---|
+| Windows NetCore Agent | `Gen7AgentCore` | `Gen7Agent.App.NetCore.exe` | - `C:\ProgramData\NNT\gen7agent.app.netcore`<br />- `C:\Program Files\NNT Change Tracker Suite\Gen7Agent (NetCore)` |
+| Linux NetCore Agent | `nntgen7agentcore` | `/opt/nnt/gen7agentcore/bin/Gen7Agent.App.NetCore` | - `/var/nnt/gen7agent.app.netcore/`<br />- `/opt/nnt/gen7agentcore/` |
+| Linux Express Agent | `nntexpressagent` | `/opt/nnt/expressagent/expressAgent` | - `/var/nnt/expressagent/`<br />- `/opt/nnt/expressagent/` |
+
+### Exclusions for Netwrix Change Tracker Hub
+
+| Service | Process | Folder |
+|---|---|---|
+| - `MongoDB`<br />- `W3SVC (Windows IIS Service)` | - `mongod.exe` (MongoDB Database Service)<br />- `w3wp.exe` (IIS Worker Process) | - `C:\Program Files\NNT Change Tracker Suite\Gen7\`<br />- `C:\inetpub\wwwroot\Change Tracker Generation 7 (NetCore) Hub`<br />- `C:\inetpub\wwwroot\Change Tracker Generation 7 (NetCore) WebUI`<br />- `C:\ProgramData\Change Tracker Generation 7 (NetCore)\MongoDB\`<br />- `C:\Program Files\NNT Change Tracker Suite\Gen7\MongoDB\` |
diff --git a/docs/kb/changetracker/configuration-and-setup/configure-fast-in-netwrix-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/configure-fast-in-netwrix-change-tracker.md
new file mode 100644
index 0000000000..c940f64d1d
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/configure-fast-in-netwrix-change-tracker.md
@@ -0,0 +1,40 @@
+---
+description: >-
+  Configuring File Approved Safe Technology (FAST) in Netwrix Change Tracker
+  by creating a Planned Change rule set with a FAST Match rule.
+keywords:
+  - FAST
+  - File Approved Safe Technology
+  - Planned Change
+  - FAST Match
+  - file monitoring
+  - Planned Change Wizard
+  - FAST Match rule
+  - FAST cloud
+  - file approved safe
+  - planned change rule set
+  - FAST configuration
+products:
+  - change-tracker
+sidebar_label: Configuring FAST
+tags:
+  - kb
+  - configuration-and-setup
+title: Configuring FAST in Netwrix Change Tracker
+knowledge_article_id: ""
+---
+
+# Configuring FAST in Netwrix Change Tracker
+
+## Overview
+
+File Approved Safe Technology (FAST) automatically reconciles known-good file changes against a cloud-based allowlist. This article describes how to configure FAST in Netwrix Change Tracker.
+
+## Instructions
+
+1. Log in to the Netwrix Change Tracker web console with an admin account.
+2. Navigate to the **Planned Changes** page.
+3. Select **Actions** > **Planned Change Wizard** > **Create a new Planned Change Rule set**.
+4. Click **Add Planned Change Rule**. In the new window, select **FAST Match** in the **Enter rule details or apply standard rule settings** dropdown list.
+5. Click **Update**.
+6. Allow **All Groups** to be tracked, and check both **No Start, Continuous** and **No End, Continuous** checkboxes.
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md b/docs/kb/changetracker/configuration-and-setup/how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md
new file mode 100644
index 0000000000..7d04173d8c
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md
@@ -0,0 +1,40 @@
+---
+description: >-
+  Exporting events from the Netwrix Change Tracker Events page to CSV, PDF,
+  or XLSX format.
+keywords:
+  - export events
+  - CSV
+  - PDF
+  - XLSX
+  - events page
+  - export limit
+  - filters
+  - event export
+  - 50000 events
+  - export button
+products:
+  - change-tracker
+sidebar_label: Exporting Events to CSV, PDF, or XLSX
+tags:
+  - kb
+  - configuration-and-setup
+title: Exporting Events from the Events Page to CSV, PDF, or XLSX
+knowledge_article_id: ""
+---
+
+# Exporting Events from the Events Page to CSV, PDF, or XLSX
+
+## Overview
+
+This article describes how to export Netwrix Change Tracker events to CSV, PDF, or XLSX format from the Events page.
+
+## Instructions
+
+1. Click the **Events** tile.
+2. Select the device to export events for. To export events for all devices, do not select a specific device.
+3. Click **Filter** and adjust the filter criteria for the event types you want to export.
+4. Review the active filters displayed at the top of the Events page. Remove any unwanted filters by clicking the **X** next to them.
+5. Click **Export** and select the preferred output format.
+
+> **NOTE:** You can export up to 50,000 events at a time. To export more than 50,000 events, see [Exporting More Than 50k Events](how-to-export-more-than-50k-events.md).
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-export-more-than-50k-events.md b/docs/kb/changetracker/configuration-and-setup/how-to-export-more-than-50k-events.md
new file mode 100644
index 0000000000..62ee3bff6a
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/how-to-export-more-than-50k-events.md
@@ -0,0 +1,51 @@
+---
+description: >-
+  Exporting more than 50,000 events from Netwrix Change Tracker using the
+  Settings Export and Import feature when the Events page export button is
+  disabled.
+keywords:
+  - export events
+  - CSV
+  - 50k limit
+  - PowerShell
+  - DeviceEvent
+  - bulk export
+  - Export and Import
+  - events.csv
+  - export greyed out
+  - export disabled
+  - 50000 events limit
+products:
+  - change-tracker
+sidebar_label: Exporting More Than 50k Events
+tags:
+  - kb
+  - configuration-and-setup
+title: Exporting More Than 50k Events
+knowledge_article_id: ""
+---
+
+# Exporting More Than 50k Events
+
+## Overview
+
+When the Events page contains more than 50,000 events, Change Tracker disables the export button. Use the **Export and Import** feature in Settings to export large event sets.
+
+## Instructions
+
+1. Navigate to **Settings** > **Export and Import**.
+2. For **Export Type**, select **Events Only**.
+3. For **Export Format**, select **Text (CSV)**.
+4. Select the **Start** and **End** dates for the export range.
+5. Click **Perform Export**.
+6. Scroll down, download the export, and unzip the CSV file.
+
+### Filtering the Exported CSV
+
+In some cases, you may need to filter the exported CSV to isolate specific event types. Open a PowerShell prompt with admin privileges, navigate to the folder containing the CSV, and run:
+
+```powershell
+Get-Content .\events.csv | Select-String 'DeviceEvent' | Set-Content DeviceEventsOnly.csv
+```
+
+This command filters the CSV to include only `DeviceEvent` rows and saves them to a new file.
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-re-register-a-deleted-device-on-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/how-to-re-register-a-deleted-device-on-change-tracker.md
new file mode 100644
index 0000000000..08fff43734
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/how-to-re-register-a-deleted-device-on-change-tracker.md
@@ -0,0 +1,41 @@
+---
+description: >-
+  Re-registering a device that was previously deleted from Netwrix Change
+  Tracker using the Agents and Devices settings page.
+keywords:
+  - re-register
+  - deleted device
+  - Agents and Devices
+  - device restore
+  - No Group Filter
+  - re-register device
+  - deleted agent
+  - device offline
+  - restore device
+  - agent re-registration
+  - No Group Filter setting
+products:
+  - change-tracker
+sidebar_label: Re-Registering a Deleted Device
+tags:
+  - kb
+  - configuration-and-setup
+title: Re-Registering a Deleted Device on Change Tracker
+knowledge_article_id: ""
+---
+
+# Re-Registering a Deleted Device on Change Tracker
+
+## Overview
+
+This article describes how to re-register a device that you previously deleted from Netwrix Change Tracker.
+
+## Instructions
+
+1. Log in to the Netwrix Change Tracker console.
+2. Navigate to **Settings** > **Agents & Devices**.
+3. Change the filter in the top-left corner to **[No Group Filter]**.
+4. The deleted devices are now visible in the **Agents & Devices** page with a **Re-Register** option.
+5. Click **Re-Register** next to the device to restore it.
+
+The device should now appear online in the Netwrix Change Tracker console.
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-retrieve-baseline-events-after-the-agent-restarts.md b/docs/kb/changetracker/configuration-and-setup/how-to-retrieve-baseline-events-after-the-agent-restarts.md
new file mode 100644
index 0000000000..3d75ec4acd
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/how-to-retrieve-baseline-events-after-the-agent-restarts.md
@@ -0,0 +1,42 @@
+---
+description: >-
+  Configuring Netwrix Change Tracker to retrieve baseline events (file lists
+  and hashes) after an agent or server restarts.
+keywords:
+  - baseline events
+  - agent restart
+  - FIM
+  - Send baseline events
+  - tracking templates
+  - file integrity
+  - baseline scan
+  - agent poll
+  - FIM baseline
+  - Editing Tracking Templates
+products:
+  - change-tracker
+sidebar_label: Retrieving Baseline Events After Restart
+tags:
+  - kb
+  - configuration-and-setup
+title: Retrieving Baseline Events After the Agent Restarts
+knowledge_article_id: ""
+---
+
+# Retrieving Baseline Events After the Agent Restarts
+
+## Overview
+
+Typically, the agent performs a baseline scan of the file system after the agent or server restarts. However, to retrieve baseline events in the Netwrix Change Tracker dashboard, you must enable specific settings first.
+
+## Instructions
+
+1. Select the template running against the device and click **Edit**.
+2. In the **Editing Tracking Templates** dialog, go to the **FIM File Integrity** tab and enable the **Send baseline events** checkbox.
+
+   > **IMPORTANT:** Enable this option for each tracker type depending on which baselines you want to retrieve.
+
+3. Navigate to **Settings** > **Agents & Devices**.
+4. Select the device and click **Edit**.
+
+Once you enable these options, the agent or server sends baseline events on the next poll.
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-setup-siem-integration-with-netwrix-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/how-to-setup-siem-integration-with-netwrix-change-tracker.md
new file mode 100644
index 0000000000..ccdb72fa43
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/how-to-setup-siem-integration-with-netwrix-change-tracker.md
@@ -0,0 +1,47 @@
+---
+description: >-
+  Configuring syslog integration to forward Netwrix Change Tracker events to a
+  Security Information and Event Management (SIEM) solution.
+keywords:
+  - SIEM integration
+  - syslog
+  - syslog server
+  - CEF
+  - UDP
+  - user notifications
+  - Security Information and Event Management
+  - syslog version
+  - User Notifications settings
+  - SIEM syslog
+products:
+  - change-tracker
+sidebar_label: Setting Up SIEM Integration
+tags:
+  - kb
+  - configuration-and-setup
+title: Setting Up SIEM Integration with Netwrix Change Tracker
+knowledge_article_id: ""
+---
+
+# Setting Up SIEM Integration with Netwrix Change Tracker
+
+## Overview
+
+You can forward Netwrix Change Tracker events to a Security Information and Event Management (SIEM) solution by configuring a syslog server connection and setting up event notifications.
+
+## Instructions
+
+### Configuring the Syslog Server
+
+1. In the Netwrix Change Tracker console, navigate to **Settings** > **System Settings**.
+2. Configure the **Syslog Server** settings according to your SIEM server's requirements:
+   - Set the syslog version to one that your SIEM supports, or to Common Event Format (CEF).
+   - Specify a UDP port for common default settings.
+3. Click **Test** to verify that the Change Tracker test message is received by your SIEM.
+
+### Configuring Event Notifications
+
+Once the syslog server is configured, set up alerts to forward specific events to your SIEM:
+
+1. In the Netwrix Change Tracker console, navigate to **Settings** > **User Notifications**.
+2. Configure the specific event types to send to your SIEM, such as Device Offline, Unplanned Changes, and others.
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-stop-change-tracker-recreating-deleted-default-groups.md b/docs/kb/changetracker/configuration-and-setup/how-to-stop-change-tracker-recreating-deleted-default-groups.md
new file mode 100644
index 0000000000..e47fb46e66
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/how-to-stop-change-tracker-recreating-deleted-default-groups.md
@@ -0,0 +1,42 @@
+---
+description: >-
+  Preventing Netwrix Change Tracker from recreating default OS groups after
+  deletion by adding the CreateDefaultGroups configuration item.
+keywords:
+  - default groups
+  - CreateDefaultGroups
+  - IIS
+  - application pool
+  - configuration settings
+  - Add Config Item
+  - System Settings
+  - Show Advanced Options
+  - IIS application pool recycle
+  - default OS groups
+  - group recreation
+products:
+  - change-tracker
+sidebar_label: Preventing Default Group Recreation
+tags:
+  - kb
+  - configuration-and-setup
+title: Preventing Change Tracker from Recreating Deleted Default Groups
+knowledge_article_id: ""
+---
+
+# Preventing Change Tracker from Recreating Deleted Default Groups
+
+## Overview
+
+The Netwrix Change Tracker console recreates default groups and their attached configuration templates and compliance reports whenever IIS recycles the application pool, which occurs every 29 hours by default.
+
+## Instructions
+
+To prevent default groups from being recreated:
+
+1. Log in to Netwrix Change Tracker.
+2. Navigate to **Settings** > **System Settings**.
+3. Click **Show Advanced Options**.
+4. Click **Add Config Item**.
+5. In the **Description** field, enter `CreateDefaultGroups`. In the **Value** field, enter `No`.
+6. Click **Update**.
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-uninstall-change-tracker-agent-via-powershell-script.md b/docs/kb/changetracker/configuration-and-setup/how-to-uninstall-change-tracker-agent-via-powershell-script.md
new file mode 100644
index 0000000000..b756169f5c
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/how-to-uninstall-change-tracker-agent-via-powershell-script.md
@@ -0,0 +1,46 @@
+---
+description: >-
+  Uninstalling the Netwrix Change Tracker agent using the silent uninstaller
+  executable via PowerShell for both NetCore and non-NetCore installations.
+keywords:
+  - uninstall
+  - PowerShell
+  - silent uninstall
+  - Gen7Agent
+  - unins000.exe
+  - agent uninstaller
+  - Gen7Agent NetCore
+  - /VERYSILENT
+  - remove agent
+  - uninstall script
+  - Change Tracker agent removal
+products:
+  - change-tracker
+sidebar_label: Uninstalling the Agent via PowerShell
+tags:
+  - kb
+  - configuration-and-setup
+title: Uninstalling the Change Tracker Agent via PowerShell
+knowledge_article_id: ""
+---
+
+# Uninstalling the Change Tracker Agent via PowerShell
+
+## Overview
+
+This article explains how to uninstall the Netwrix Change Tracker agent using a PowerShell script.
+
+## Instructions
+
+Navigate to the uninstaller location based on your installation type:
+
+- **NetCore installation:** `C:\Program Files\NNT Change Tracker Suite\Gen7Agent (NetCore)\unins000.exe`
+- **Non-NetCore installation:** `C:\Program Files\NNT Change Tracker Suite\Gen7Agent\unins000.exe`
+
+Run the following command:
+
+```powershell
+.\unins000.exe /SP-- /VERYSILENT /SUPPRESSMSGBOXES
+```
+
+> **NOTE:** Netwrix Change Tracker does not have a built-in silent uninstall feature. This method uses the installer's silent mode switches.
diff --git a/docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md b/docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md
new file mode 100644
index 0000000000..dff7d008b2
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md
@@ -0,0 +1,43 @@
+---
+description: >-
+  Supported TLS versions for in-transit encryption and MongoDB at-rest
+  encryption options for Netwrix Change Tracker.
+keywords:
+  - in-transit encryption
+  - at-rest encryption
+  - TLS
+  - MongoDB
+  - ASP.NET Core
+  - data protection
+  - TLS 1.3
+  - MongoDB Enterprise
+  - MongoDB Community
+  - encryption at rest
+  - data encryption
+products:
+  - change-tracker
+sidebar_label: In-Transit and At-Rest Data Encryption
+tags:
+  - kb
+  - configuration-and-setup
+title: In-Transit and At-Rest Data Encryption
+knowledge_article_id: ""
+---
+
+# In-Transit and At-Rest Data Encryption
+
+## Overview
+
+This article covers the supported encryption options for Netwrix Change Tracker data both in transit and at rest.
+
+## Instructions
+
+### In-Transit Encryption
+
+Netwrix Change Tracker supports Transport Layer Security (TLS) protocol version 1.3 and earlier for in-transit data encryption. Disable nontarget protocol versions in your environment to ensure you use the intended TLS version.
+
+### At-Rest Encryption
+
+MongoDB Community Edition, which is included in the Netwrix Change Tracker installation wizard, does not support at-rest data encryption. This feature is available in MongoDB Enterprise only. For details, see [MongoDB Encryption At-Rest](https://www.mongodb.com/docs/manual/core/security-encryption-at-rest/).
+
+> **IMPORTANT:** The ASP.NET Core data protection API encrypts data such as user accounts, passwords, and network device credentials by default. Both MongoDB Community and Enterprise editions encrypt this type of data.
diff --git a/docs/kb/changetracker/configuration-and-setup/resubmit-a-group-of-unplanned-changes.md b/docs/kb/changetracker/configuration-and-setup/resubmit-a-group-of-unplanned-changes.md
new file mode 100644
index 0000000000..7f8d3fe5df
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/resubmit-a-group-of-unplanned-changes.md
@@ -0,0 +1,44 @@
+---
+description: >-
+  Using the Planned Change Wizard to create a planned change schedule and
+  resubmit unplanned events in bulk in Netwrix Change Tracker.
+keywords:
+  - resubmit events
+  - planned change
+  - bulk resubmit
+  - Planned Change Wizard
+  - unplanned changes
+  - resubmit unplanned changes
+  - Events tab
+  - All Events
+  - Actions menu
+  - planned change rule set
+  - event resubmission
+products:
+  - change-tracker
+sidebar_label: Resubmitting Unplanned Changes in Bulk
+tags:
+  - kb
+  - configuration-and-setup
+title: Resubmitting a Group of Unplanned Changes
+knowledge_article_id: ""
+---
+
+# Resubmitting a Group of Unplanned Changes
+
+## Overview
+
+This article describes how to resubmit unplanned changes in bulk in Netwrix Change Tracker by creating a planned change schedule and resubmitting the events.
+
+## Instructions
+
+1. Navigate to the **Planned Changes** tab and click **Actions** > **Planned Change Wizard**.
+2. Click **Next** and proceed with the **Create a new Planned Change Rule Set** option.
+3. Create a rule to match the events. You can match all events using `Any` for all options, or specify a path for the events.
+4. Once the rules are created, click **Next** and proceed with customizing the planned change.
+5. Select the **Group of Devices** and the **Date/Time** range during which the events occurred.
+6. Continue through the wizard and customize the name and description.
+7. After the planned change is created, navigate to the **Events** tab and filter the events.
+8. On the **Events** page, select the **All Events** option and click **Actions** > **Resubmit selected events**.
+
+Change Tracker verifies the resubmitted events against the planned change rules.
diff --git a/docs/kb/changetracker/configuration-and-setup/what-special-characters-can-be-used-in-a-change-tracker-user-or-agent-password.md b/docs/kb/changetracker/configuration-and-setup/what-special-characters-can-be-used-in-a-change-tracker-user-or-agent-password.md
new file mode 100644
index 0000000000..eb9964aac7
--- /dev/null
+++ b/docs/kb/changetracker/configuration-and-setup/what-special-characters-can-be-used-in-a-change-tracker-user-or-agent-password.md
@@ -0,0 +1,45 @@
+---
+description: >-
+  Supported special characters for Netwrix Change Tracker user and agent
+  passwords, and how to configure local password requirements.
+keywords:
+  - password
+  - special characters
+  - PCI-DSS
+  - user accounts
+  - agent passwords
+  - password policy
+  - password requirements
+  - agent authentication
+  - special character list
+  - user password settings
+  - System Settings
+products:
+  - change-tracker
+sidebar_label: Special Characters in Passwords
+tags:
+  - kb
+  - configuration-and-setup
+title: Supported Special Characters for User and Agent Passwords
+knowledge_article_id: ""
+---
+
+# Supported Special Characters for User and Agent Passwords
+
+## Overview
+
+Administrators responsible for Netwrix Change Tracker and its user accounts should change default passwords to strong, unique passwords immediately. Attackers can exploit weak or default credentials to propagate an attack if they compromise a system.
+
+Payment Card Industry Data Security Standard (PCI-DSS) Requirement 2 specifically states that an organization cannot use vendor-supplied defaults for system passwords and other security parameters.
+
+## Instructions
+
+### Supported Special Characters
+
+When creating passwords that include special characters, use only the characters from the following list to ensure that remote agents and users can connect and log in successfully:
+
+**! ? . , $ # * ' ; / : @ ~ ( ) _ +**
+
+### Configuring Local Password Requirements
+
+If you cannot integrate Netwrix Change Tracker with your Active Directory server, configure local user password requirements through **Settings** > **System Settings**, under the **User Password Settings** heading.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/change-tracker-agent-does-not-run-on-rhel-8-or-9.md b/docs/kb/changetracker/troubleshooting-and-errors/change-tracker-agent-does-not-run-on-rhel-8-or-9.md
new file mode 100644
index 0000000000..2826260988
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/change-tracker-agent-does-not-run-on-rhel-8-or-9.md
@@ -0,0 +1,80 @@
+---
+description: >-
+  Resolving an issue where the Netwrix Change Tracker agent cannot start on
+  RHEL 8 or 9 due to default cryptographic policy changes, by applying a
+  custom subpolicy.
+keywords:
+  - change tracker agent
+  - RHEL 8
+  - RHEL 9
+  - crypto policies
+  - GEN7AGENT.pmod
+  - SHA1
+  - update-crypto-policies
+  - RSA-SHA1
+  - NetCore Agent
+  - crypto policy subpolicy
+products:
+  - change-tracker
+sidebar_label: Agent Does Not Run on RHEL 8 or 9
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: Change Tracker Agent Does Not Run on RHEL 8 or 9
+knowledge_article_id: ""
+---
+
+# Change Tracker Agent Does Not Run on RHEL 8 or 9
+
+## Symptom
+
+Affected versions:
+
+- Netwrix Change Tracker NetCore Agent — version 7.0.1.9-255 and later
+
+Error on agent service startup:
+
+```text
+[1] INFO Message - Application core shutting down due to error, please restart service:
+This license is invalid. Please see servicestack.net or contact team@servicestack.net for more details.
+The id for this license is '<id>'
+```
+
+## Cause
+
+The Netwrix Change Tracker agent cannot run due to cryptographic policy changes that Red Hat Enterprise Linux (RHEL) 8 or 9 applies by default.
+
+## Resolution
+
+1. On the RHEL server hosting the Change Tracker agent, open the terminal and navigate to the crypto policies modules directory:
+
+   ```bash
+   cd /usr/share/crypto-policies/policies/modules
+   ```
+
+2. Create a new file called `GEN7AGENT.pmod` and open it:
+
+   ```bash
+   touch GEN7AGENT.pmod
+   vi /usr/share/crypto-policies/policies/modules/GEN7AGENT.pmod
+   ```
+
+3. Add the following lines to the file:
+
+   ```text
+   # This subpolicy adds SHA1 hash and signature support
+
+   hash = SHA1+
+
+   sign = RSA-SHA1+
+   ```
+
+4. Apply the updated crypto policy:
+
+   ```bash
+   update-crypto-policies --set DEFAULT:GEN7AGENT
+   ```
+
+5. Reboot the RHEL system hosting the agent.
+
+The Netwrix Change Tracker agent should run after you apply the subpolicies.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md b/docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md
new file mode 100644
index 0000000000..30f208dbbd
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md
@@ -0,0 +1,49 @@
+---
+description: >-
+  Resolving Error 503 when the Netwrix Change Tracker login screen is
+  unavailable due to the web application pool not running or incorrect
+  application pool identity credentials.
+keywords:
+  - error 503
+  - application pool
+  - IIS
+  - identity credentials
+  - server unavailable
+  - IIS Manager
+  - application pool stopped
+  - Change Tracker login
+  - 503 Service Unavailable
+  - web application pool identity
+products:
+  - change-tracker
+sidebar_label: Error 503 — Unable to Access Login Screen
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: "Error 503 — Unable to Access Change Tracker Login Screen"
+knowledge_article_id: ""
+---
+
+# Error 503 — Unable to Access Change Tracker Login Screen
+
+## Symptom
+
+The following error appears when attempting to access Netwrix Change Tracker:
+
+```text
+Connection to server lost
+Server unavailable since <datestamp> (local),
+(503)
+```
+
+## Cause
+
+The Netwrix Change Tracker web application pool is not running. The application pool may fail to start if the custom **Identity** user has incorrect credentials.
+
+## Resolution
+
+1. In the left pane of **IIS Manager**, select the **Application Pools** page.
+2. Locate the Change Tracker web application pool, right-click it, and select **Advanced Settings...**
+3. Under the **Process Model** section, locate the **Identity** node, select it, and click the ellipsis button.
+4. Click **Set...**, and specify new credentials for the account to run the application pool.
+5. Click **OK** > **OK** > **OK** to save changes. Right-click the pool and select **Start** to run it.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md b/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md
new file mode 100644
index 0000000000..8d5201c559
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md
@@ -0,0 +1,46 @@
+---
+description: >-
+  Resolving the "file is being used by another process" error when running a
+  report in Netwrix Change Tracker, typically caused by antivirus or EDR
+  solutions locking the report file.
+keywords:
+  - file in use
+  - antivirus exclusion
+  - EDR
+  - real-time scan
+  - report error
+  - file locked
+  - C:\Windows\TEMP
+  - process cannot access file
+  - AV conflict
+  - report generation error
+products:
+  - change-tracker
+sidebar_label: File Is Being Used by Another Process Error
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: File Is Being Used by Another Process Error in Netwrix Change Tracker
+knowledge_article_id: ""
+---
+
+# File Is Being Used by Another Process Error in Netwrix Change Tracker
+
+## Symptom
+
+The following error appears when attempting to run a report in Netwrix Change Tracker:
+
+```text
+The process cannot access the file '<path_to_file>' because it is being used by another process.
+```
+
+The `<path_to_file>` may differ depending on the affected report. For example: `C:\Windows\TEMP\1-11530090-NNT CIS Microsoft Windows Server 2012 R2 Benchmark - Level 2 Member Server.json`.
+
+## Cause
+
+An antivirus (AV) or endpoint detection and response (EDR) solution in the environment is conflicting with Netwrix Change Tracker.
+
+## Resolution
+
+- Exclude the top-level folder of the affected path from the monitoring scope of your AV or EDR solution to prevent further conflicts. This applies to real-time scans and backups. For the example path above, exclude `C:\Windows\TEMP`.
+- Exclude Netwrix Change Tracker folders, services, and processes from the monitoring scope of your AV and EDR. Refer to [Antivirus Exclusions for Netwrix Change Tracker](https://helpcenter.netwrix.com/bundle/z-kb-articles-salesforce/page/kA04u00000111HFCAY.html) for additional information.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/how-to-fix-error-the-requested-event-counts-summary-size.md b/docs/kb/changetracker/troubleshooting-and-errors/how-to-fix-error-the-requested-event-counts-summary-size.md
new file mode 100644
index 0000000000..7b91a05856
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/how-to-fix-error-the-requested-event-counts-summary-size.md
@@ -0,0 +1,48 @@
+---
+description: >-
+  Resolving the "Error, the requested event counts summary size cannot be
+  smaller than the system event count window size" message in Netwrix Change
+  Tracker by correcting the EventStatsUnitSeconds configuration value.
+keywords:
+  - event counts
+  - EventStatsUnitSeconds
+  - system event count window
+  - dashboard error
+  - configuration settings
+  - "86400"
+  - device tab
+  - Show Advanced Options
+  - Add Config Item
+  - event count window size error
+products:
+  - change-tracker
+sidebar_label: Event Counts Summary Size Error
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: "Event Counts Summary Size Error"
+knowledge_article_id: ""
+---
+
+# Event Counts Summary Size Error
+
+## Symptom
+
+When browsing to the Netwrix Change Tracker **Dashboard** tab or the **Device** tab, a red error message appears:
+
+> **Error, the requested event counts summary size cannot be smaller than the system event count window size**
+
+## Cause
+
+The `EventStatsUnitSeconds` configuration item is not set to a factor of `86400`. The default value is `1800`. If the current value is not a whole number multiple of `86400`, this error appears.
+
+## Resolution
+
+1. Log in to Netwrix Change Tracker.
+2. Navigate to **Settings** > **System Settings**.
+3. Scroll to the bottom of the page and click **Show Advanced Options**.
+4. Under **Configuration Settings**, look for the description `EventStatsUnitSeconds`.
+5. If the config item does not exist, click **Add Config Item** to create it.
+6. If the value is not set or is not `1800`, click the **Edit** button next to `EventStatsUnitSeconds` and change the value to `1800`.
+7. Click **Update**.
+8. Log out and log back in to Netwrix Change Tracker.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md b/docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md
new file mode 100644
index 0000000000..3ef904fdfe
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md
@@ -0,0 +1,52 @@
+---
+description: >-
+  Resolving the "Number of pages in the report will exceed 250" error in
+  Netwrix Change Tracker by increasing the MaxPagesInReport configuration
+  setting.
+keywords:
+  - MaxPagesInReport
+  - report pages
+  - page count
+  - QueryError
+  - report limit
+  - 250 pages
+  - configuration settings
+  - Show Advanced Options
+  - Add Config Item
+  - report page limit exceeded
+products:
+  - change-tracker
+sidebar_label: Pages in Report Exceed 250 Error
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: Pages in Report Exceed 250 Error
+knowledge_article_id: ""
+---
+
+# Pages in Report Exceed 250 Error
+
+## Symptom
+
+When attempting to run a report in Netwrix Change Tracker, the following error appears:
+
+```text
+TemplateId: <template_name>
+Results State: QueryError
+Number of pages in the report will exceed 250 - Estimated Total Page Count <page_count>
+```
+
+## Cause
+
+The estimated page count for the report exceeds the predefined limit.
+
+## Resolution
+
+Increase the maximum allowed page count:
+
+1. In Netwrix Change Tracker, navigate to **Settings** > **System Settings** > **Show Advanced Options**.
+2. In the **Configuration Settings** section, click **Add Config Item**. In the **Description** field, enter `MaxPagesInReport`. In the **Value** field, enter `2000`.
+
+   > **NOTE:** You can enter any value to cover the required target page count. The value `2000` is used as an example.
+
+3. Click **Update**. Run the affected report again.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/redis-qfork-dat-files-taking-up-large-amounts-of-disk-space.md b/docs/kb/changetracker/troubleshooting-and-errors/redis-qfork-dat-files-taking-up-large-amounts-of-disk-space.md
new file mode 100644
index 0000000000..9d90f1b8e0
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/redis-qfork-dat-files-taking-up-large-amounts-of-disk-space.md
@@ -0,0 +1,46 @@
+---
+description: >-
+  Explaining what Redis QFork.dat files are, where they are stored for
+  Netwrix Change Tracker, and when it is safe to delete them to recover
+  disk space.
+keywords:
+  - Redis
+  - QFork.dat
+  - disk space
+  - memory mapped file
+  - snapshot
+  - Windows
+  - NetworkService
+  - AppData
+  - Redis service
+  - disk space recovery
+  - Redis Windows fork
+products:
+  - change-tracker
+sidebar_label: Redis QFork.dat Disk Space
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: Redis QFork.dat Files Taking Up Large Amounts of Disk Space
+knowledge_article_id: ""
+---
+
+# Redis QFork.dat Files Taking Up Large Amounts of Disk Space
+
+## Symptom
+
+The server hosting the Netwrix Change Tracker web console is running low on disk space. Scanning the server's disks reveals that Redis QFork.dat files are consuming significant storage.
+
+These files are normally stored in the following directory:
+
+```text
+C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Redis
+```
+
+## Cause
+
+Redis uses the fork UNIX system API to create a point-in-time snapshot of the data store on disk. Windows does not have a fork-like API, so Redis simulates this behavior by placing the Redis heap in a memory mapped file that a child (quasi-forked) process can access. By default, the size of each snapshot file equals the size of the device's physical memory.
+
+## Resolution
+
+**It is safe to delete these files**, as long as the Redis service is not running. Stop the Redis service before deleting the QFork.dat files, then restart the service.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/system-error-when-running-event-queries.md b/docs/kb/changetracker/troubleshooting-and-errors/system-error-when-running-event-queries.md
new file mode 100644
index 0000000000..7e324a32ce
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/system-error-when-running-event-queries.md
@@ -0,0 +1,50 @@
+---
+description: >-
+  Resolving "System Error" messages when running event queries with text
+  search in Netwrix Change Tracker by switching to regex search and
+  increasing query timeouts.
+keywords:
+  - text search
+  - event query
+  - timeout
+  - TextSearchMethod
+  - regex
+  - MaxEventQueryTimeMs
+  - System Error
+  - event filter timeout
+  - MaxEventCountTimeMs
+products:
+  - change-tracker
+sidebar_label: System Error When Running Event Queries
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: System Error When Running Event Queries
+knowledge_article_id: ""
+---
+
+# System Error When Running Event Queries
+
+## Symptom
+
+In Netwrix Change Tracker, when an Events query includes a text search, a "System Error" message appears in the lower-right corner of the screen, indicating the query cannot complete successfully or that it will time out.
+
+## Cause
+
+The default `TextSearchMethod` setting is `Text`, which cannot handle the complexity of the query.
+
+## Resolution
+
+1. Log in to Change Tracker.
+2. Navigate to **Settings** > **System Settings**.
+3. Scroll down and click **Show Advanced Options** at the bottom of the page.
+4. Scroll down to **Configuration Settings** and click **Add Config Item**.
+5. Add the following configuration items:
+
+   | Description | Value |
+   |---|---|
+   | `TextSearchMethod` | `regex` |
+   | `MaxEventQueryTimeMs` | `600000` |
+   | `MaxEventCountTimeMs` | `5000` |
+
+6. Click **Update**.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/unable-to-upload-agent-update-files.md b/docs/kb/changetracker/troubleshooting-and-errors/unable-to-upload-agent-update-files.md
new file mode 100644
index 0000000000..a0e7f4093d
--- /dev/null
+++ b/docs/kb/changetracker/troubleshooting-and-errors/unable-to-upload-agent-update-files.md
@@ -0,0 +1,76 @@
+---
+description: >-
+  Resolving the "System Error / An unknown error occurred" message when
+  uploading agent updates in Netwrix Change Tracker by increasing the IIS
+  maxAllowedContentLength value.
+keywords:
+  - agent update
+  - upload failed
+  - IIS
+  - Web.config
+  - maxAllowedContentLength
+  - requestFiltering
+  - agent update upload error
+  - request size limit
+  - iisreset
+  - 250000000
+products:
+  - change-tracker
+sidebar_label: Unable to Upload Agent Update Files
+tags:
+  - kb
+  - troubleshooting-and-errors
+title: Unable to Upload Agent Update Files
+knowledge_article_id: ""
+---
+
+# Unable to Upload Agent Update Files
+
+## Symptom
+
+When attempting to upload agent updates in Netwrix Change Tracker, the following errors appear:
+
+```text
+System Error
+An unknown error occurred
+```
+
+```text
+<number> File(s) failed to upload
+```
+
+## Cause
+
+The default maximum file upload size in Internet Information Services (IIS) is too low for the agent update files.
+
+## Resolution
+
+Increase the file upload size limit in `Web.config`:
+
+1. Stop all IIS services by running the following command in an elevated Command Prompt:
+
+   ```bat
+   iisreset /stop
+   ```
+
+2. Open the `Web.config` file:
+
+   ```text
+   C:\inetpub\wwwroot\Change Tracker Generation 7 (NetCore) Hub\Web.config
+   ```
+
+3. Modify the `<requestFiltering>` node to increase the allowed content length:
+
+   ```xml
+   <requestFiltering>
+       <requestLimits maxAllowedContentLength="250000000" />
+   </requestFiltering>
+   ```
+
+4. Save the changes and start IIS services:
+
+   ```bat
+   iisreset /start
+   ```
+
+5. Log in to the Change Tracker console and reupload the update files.

From e87251f2970cbf1a6a1bfc36e51d50aa383e19cf Mon Sep 17 00:00:00 2001
From: hilram7 <212961752+hilram7@users.noreply.github.com>
Date: Mon, 8 Jun 2026 15:15:35 -0400
Subject: [PATCH 2/7] fix(kb): replace broken Salesforce URL with local
 relative link

Replaces dead helpcenter.netwrix.com Salesforce URL with a relative
link to the antivirus exclusions article now in this repo.
---
 ...g-used-by-another-process-error-in-netwrix-change-tracker.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md b/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md
index 8d5201c559..27cb1de614 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md
@@ -43,4 +43,4 @@ An antivirus (AV) or endpoint detection and response (EDR) solution in the envir
 ## Resolution
 
 - Exclude the top-level folder of the affected path from the monitoring scope of your AV or EDR solution to prevent further conflicts. This applies to real-time scans and backups. For the example path above, exclude `C:\Windows\TEMP`.
-- Exclude Netwrix Change Tracker folders, services, and processes from the monitoring scope of your AV and EDR. Refer to [Antivirus Exclusions for Netwrix Change Tracker](https://helpcenter.netwrix.com/bundle/z-kb-articles-salesforce/page/kA04u00000111HFCAY.html) for additional information.
+- Exclude Netwrix Change Tracker folders, services, and processes from the monitoring scope of your AV and EDR. Refer to [Antivirus Exclusions for Netwrix Change Tracker](../configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md) for additional information.

From a0cbe8b9bca03ec696d93c6f949dbc3354079137 Mon Sep 17 00:00:00 2001
From: hilram7 <212961752+hilram7@users.noreply.github.com>
Date: Mon, 8 Jun 2026 15:18:58 -0400
Subject: [PATCH 3/7] refactor(kb): rename Change Tracker KB files to match
 sidebar label order

Renames 12 files so filenames begin with the topic word, matching the
accessanalyzer convention and ensuring autogenerated sidebar order
aligns with alphabetical sidebar label order. Updates one internal
cross-reference affected by the rename.
---
 ...re-fast-in-netwrix-change-tracker.md => configuring-fast.md} | 0
 ...sv-pdf-or-xlsx.md => exporting-events-to-csv-pdf-or-xlsx.md} | 2 +-
 ...ore-than-50k-events.md => exporting-more-than-50k-events.md} | 0
 ...default-groups.md => preventing-default-group-recreation.md} | 0
 ...-on-change-tracker.md => re-registering-a-deleted-device.md} | 0
 ...-restarts.md => retrieving-baseline-events-after-restart.md} | 0
 ...netwrix-change-tracker.md => setting-up-siem-integration.md} | 0
 ...-or-agent-password.md => special-characters-in-passwords.md} | 0
 ...shell-script.md => uninstalling-the-agent-via-powershell.md} | 0
 ...n-on-rhel-8-or-9.md => agent-does-not-run-on-rhel-8-or-9.md} | 0
 ...ounts-summary-size.md => event-counts-summary-size-error.md} | 0
 ...racker.md => file-is-being-used-by-another-process-error.md} | 0
 12 files changed, 1 insertion(+), 1 deletion(-)
 rename docs/kb/changetracker/configuration-and-setup/{configure-fast-in-netwrix-change-tracker.md => configuring-fast.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md => exporting-events-to-csv-pdf-or-xlsx.md} (96%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-export-more-than-50k-events.md => exporting-more-than-50k-events.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-stop-change-tracker-recreating-deleted-default-groups.md => preventing-default-group-recreation.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-re-register-a-deleted-device-on-change-tracker.md => re-registering-a-deleted-device.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-retrieve-baseline-events-after-the-agent-restarts.md => retrieving-baseline-events-after-restart.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-setup-siem-integration-with-netwrix-change-tracker.md => setting-up-siem-integration.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{what-special-characters-can-be-used-in-a-change-tracker-user-or-agent-password.md => special-characters-in-passwords.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-uninstall-change-tracker-agent-via-powershell-script.md => uninstalling-the-agent-via-powershell.md} (100%)
 rename docs/kb/changetracker/troubleshooting-and-errors/{change-tracker-agent-does-not-run-on-rhel-8-or-9.md => agent-does-not-run-on-rhel-8-or-9.md} (100%)
 rename docs/kb/changetracker/troubleshooting-and-errors/{how-to-fix-error-the-requested-event-counts-summary-size.md => event-counts-summary-size-error.md} (100%)
 rename docs/kb/changetracker/troubleshooting-and-errors/{file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md => file-is-being-used-by-another-process-error.md} (100%)

diff --git a/docs/kb/changetracker/configuration-and-setup/configure-fast-in-netwrix-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/configuring-fast.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/configure-fast-in-netwrix-change-tracker.md
rename to docs/kb/changetracker/configuration-and-setup/configuring-fast.md
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md b/docs/kb/changetracker/configuration-and-setup/exporting-events-to-csv-pdf-or-xlsx.md
similarity index 96%
rename from docs/kb/changetracker/configuration-and-setup/how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md
rename to docs/kb/changetracker/configuration-and-setup/exporting-events-to-csv-pdf-or-xlsx.md
index 7d04173d8c..2fe086bd0c 100644
--- a/docs/kb/changetracker/configuration-and-setup/how-to-export-events-from-the-events-page-to-csv-pdf-or-xlsx.md
+++ b/docs/kb/changetracker/configuration-and-setup/exporting-events-to-csv-pdf-or-xlsx.md
@@ -37,4 +37,4 @@ This article describes how to export Netwrix Change Tracker events to CSV, PDF,
 4. Review the active filters displayed at the top of the Events page. Remove any unwanted filters by clicking the **X** next to them.
 5. Click **Export** and select the preferred output format.
 
-> **NOTE:** You can export up to 50,000 events at a time. To export more than 50,000 events, see [Exporting More Than 50k Events](how-to-export-more-than-50k-events.md).
+> **NOTE:** You can export up to 50,000 events at a time. To export more than 50,000 events, see [Exporting More Than 50k Events](exporting-more-than-50k-events.md).
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-export-more-than-50k-events.md b/docs/kb/changetracker/configuration-and-setup/exporting-more-than-50k-events.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-export-more-than-50k-events.md
rename to docs/kb/changetracker/configuration-and-setup/exporting-more-than-50k-events.md
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-stop-change-tracker-recreating-deleted-default-groups.md b/docs/kb/changetracker/configuration-and-setup/preventing-default-group-recreation.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-stop-change-tracker-recreating-deleted-default-groups.md
rename to docs/kb/changetracker/configuration-and-setup/preventing-default-group-recreation.md
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-re-register-a-deleted-device-on-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/re-registering-a-deleted-device.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-re-register-a-deleted-device-on-change-tracker.md
rename to docs/kb/changetracker/configuration-and-setup/re-registering-a-deleted-device.md
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-retrieve-baseline-events-after-the-agent-restarts.md b/docs/kb/changetracker/configuration-and-setup/retrieving-baseline-events-after-restart.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-retrieve-baseline-events-after-the-agent-restarts.md
rename to docs/kb/changetracker/configuration-and-setup/retrieving-baseline-events-after-restart.md
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-setup-siem-integration-with-netwrix-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/setting-up-siem-integration.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-setup-siem-integration-with-netwrix-change-tracker.md
rename to docs/kb/changetracker/configuration-and-setup/setting-up-siem-integration.md
diff --git a/docs/kb/changetracker/configuration-and-setup/what-special-characters-can-be-used-in-a-change-tracker-user-or-agent-password.md b/docs/kb/changetracker/configuration-and-setup/special-characters-in-passwords.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/what-special-characters-can-be-used-in-a-change-tracker-user-or-agent-password.md
rename to docs/kb/changetracker/configuration-and-setup/special-characters-in-passwords.md
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-uninstall-change-tracker-agent-via-powershell-script.md b/docs/kb/changetracker/configuration-and-setup/uninstalling-the-agent-via-powershell.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-uninstall-change-tracker-agent-via-powershell-script.md
rename to docs/kb/changetracker/configuration-and-setup/uninstalling-the-agent-via-powershell.md
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/change-tracker-agent-does-not-run-on-rhel-8-or-9.md b/docs/kb/changetracker/troubleshooting-and-errors/agent-does-not-run-on-rhel-8-or-9.md
similarity index 100%
rename from docs/kb/changetracker/troubleshooting-and-errors/change-tracker-agent-does-not-run-on-rhel-8-or-9.md
rename to docs/kb/changetracker/troubleshooting-and-errors/agent-does-not-run-on-rhel-8-or-9.md
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/how-to-fix-error-the-requested-event-counts-summary-size.md b/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
similarity index 100%
rename from docs/kb/changetracker/troubleshooting-and-errors/how-to-fix-error-the-requested-event-counts-summary-size.md
rename to docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md b/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error.md
similarity index 100%
rename from docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error-in-netwrix-change-tracker.md
rename to docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error.md

From 99e1446b773af2e8d983af19217ffa64724926b0 Mon Sep 17 00:00:00 2001
From: hilram7 <212961752+hilram7@users.noreply.github.com>
Date: Mon, 8 Jun 2026 15:25:22 -0400
Subject: [PATCH 4/7] refactor(kb): rename pre-existing Change Tracker KB files
 to match sidebar labels

Renames 5 pre-existing files so filenames begin with the topic word,
consistent with the convention applied to the batch-1 articles and
the accessanalyzer KB. No cross-references affected.
---
 ...-trackerto-function.md => network-ports-for-change-tracker.md} | 0
 ...nge-tracker-console.md => updating-agents-from-the-console.md} | 0
 ...address_blocked_loginfailures.md => 403-ip-address-blocked.md} | 0
 ...does_not_match_trust.md => certificate-thumbprint-mismatch.md} | 0
 ....md => determining-if-the-default-agent-password-is-in-use.md} | 0
 5 files changed, 0 insertions(+), 0 deletions(-)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-determine-what-network-ports-need-to-be-open-for-change-tracker-or-log-trackerto-function.md => network-ports-for-change-tracker.md} (100%)
 rename docs/kb/changetracker/configuration-and-setup/{how-to-update-agents-from-the-change-tracker-console.md => updating-agents-from-the-console.md} (100%)
 rename docs/kb/changetracker/troubleshooting-and-errors/{rolling-log_fix_hub_connection_failed._403_server_message_ip_address_blocked_loginfailures.md => 403-ip-address-blocked.md} (100%)
 rename docs/kb/changetracker/troubleshooting-and-errors/{rolling-log_fix_error_nnt.hub.serviceclient.hubadapter_-_certificate_thumbprint_does_not_match_trust.md => certificate-thumbprint-mismatch.md} (100%)
 rename docs/kb/changetracker/troubleshooting-and-errors/{how-to-determine-if-the-default-agent-password-is-in-use.md => determining-if-the-default-agent-password-is-in-use.md} (100%)

diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-determine-what-network-ports-need-to-be-open-for-change-tracker-or-log-trackerto-function.md b/docs/kb/changetracker/configuration-and-setup/network-ports-for-change-tracker.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-determine-what-network-ports-need-to-be-open-for-change-tracker-or-log-trackerto-function.md
rename to docs/kb/changetracker/configuration-and-setup/network-ports-for-change-tracker.md
diff --git a/docs/kb/changetracker/configuration-and-setup/how-to-update-agents-from-the-change-tracker-console.md b/docs/kb/changetracker/configuration-and-setup/updating-agents-from-the-console.md
similarity index 100%
rename from docs/kb/changetracker/configuration-and-setup/how-to-update-agents-from-the-change-tracker-console.md
rename to docs/kb/changetracker/configuration-and-setup/updating-agents-from-the-console.md
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/rolling-log_fix_hub_connection_failed._403_server_message_ip_address_blocked_loginfailures.md b/docs/kb/changetracker/troubleshooting-and-errors/403-ip-address-blocked.md
similarity index 100%
rename from docs/kb/changetracker/troubleshooting-and-errors/rolling-log_fix_hub_connection_failed._403_server_message_ip_address_blocked_loginfailures.md
rename to docs/kb/changetracker/troubleshooting-and-errors/403-ip-address-blocked.md
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/rolling-log_fix_error_nnt.hub.serviceclient.hubadapter_-_certificate_thumbprint_does_not_match_trust.md b/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
similarity index 100%
rename from docs/kb/changetracker/troubleshooting-and-errors/rolling-log_fix_error_nnt.hub.serviceclient.hubadapter_-_certificate_thumbprint_does_not_match_trust.md
rename to docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/how-to-determine-if-the-default-agent-password-is-in-use.md b/docs/kb/changetracker/troubleshooting-and-errors/determining-if-the-default-agent-password-is-in-use.md
similarity index 100%
rename from docs/kb/changetracker/troubleshooting-and-errors/how-to-determine-if-the-default-agent-password-is-in-use.md
rename to docs/kb/changetracker/troubleshooting-and-errors/determining-if-the-default-agent-password-is-in-use.md

From 8aa3ddaac59c21a354fef8240f3928089f768eab Mon Sep 17 00:00:00 2001
From: hilram7 <212961752+hilram7@users.noreply.github.com>
Date: Mon, 8 Jun 2026 15:33:47 -0400
Subject: [PATCH 5/7] fix(kb): fix error message format and Symptoms headings
 in Change Tracker KB

Converts bold blockquote to code block for error message in
event-counts-summary-size-error. Changes Symptoms to Symptom in
certificate-thumbprint-mismatch and corrupt-errorevent-in-event-reports.
---
 .../audit-and-logging/corrupt-errorevent-in-event-reports.md  | 2 +-
 .../certificate-thumbprint-mismatch.md                        | 2 +-
 .../event-counts-summary-size-error.md                        | 4 +++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/docs/kb/changetracker/audit-and-logging/corrupt-errorevent-in-event-reports.md b/docs/kb/changetracker/audit-and-logging/corrupt-errorevent-in-event-reports.md
index 10660a1ff9..439ddbf1f8 100644
--- a/docs/kb/changetracker/audit-and-logging/corrupt-errorevent-in-event-reports.md
+++ b/docs/kb/changetracker/audit-and-logging/corrupt-errorevent-in-event-reports.md
@@ -26,7 +26,7 @@ knowledge_article_id: kA0Qk0000000ahpKAA
 
 # Corrupt ErrorEvent in Event Reports
 
-## Symptoms
+## Symptom
 
 - The events report in Netwrix Change Tracker contains one or more `ErrorEvent` events. Their description states `Corrupt`.
 - Agent logs (see [Rolling-Log File Location](/docs/changetracker/8_1/install/agent/rollinglogfile)) contain the following line:
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md b/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
index 94ed6c0a09..e543345f99 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
@@ -15,7 +15,7 @@ products:
 
 # Rolling-Log Fix: "ERROR NNT.Hub.ServiceClient.HubAdapter - Certificate Thumbprint Does Not Match Trusted"
 
-## Symptoms
+## Symptom
 
 The following error occurs when using a custom or unrecognized IIS Certificate:
 
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md b/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
index 7b91a05856..c40fcb0767 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
@@ -30,7 +30,9 @@ knowledge_article_id: ""
 
 When browsing to the Netwrix Change Tracker **Dashboard** tab or the **Device** tab, a red error message appears:
 
-> **Error, the requested event counts summary size cannot be smaller than the system event count window size**
+```text
+Error, the requested event counts summary size cannot be smaller than the system event count window size
+```
 
 ## Cause
 

From de53d19a2e840edf6737707f1b7473253b392cba Mon Sep 17 00:00:00 2001
From: hilram7 <212961752+hilram7@users.noreply.github.com>
Date: Mon, 8 Jun 2026 15:34:39 -0400
Subject: [PATCH 6/7] fix(kb): align titles and H1s with sidebar labels in
 pre-existing Change Tracker KB articles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Updates certificate-thumbprint-mismatch and 403-ip-address-blocked to
use short, label-matching titles instead of legacy Rolling-Log Fix
prefixes. Also fixes remaining Symptoms → Symptom in 403 article.
---
 .../troubleshooting-and-errors/403-ip-address-blocked.md    | 6 +++---
 .../certificate-thumbprint-mismatch.md                      | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/kb/changetracker/troubleshooting-and-errors/403-ip-address-blocked.md b/docs/kb/changetracker/troubleshooting-and-errors/403-ip-address-blocked.md
index c4209942bd..7e413e6dd4 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/403-ip-address-blocked.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/403-ip-address-blocked.md
@@ -7,15 +7,15 @@ keywords:
   - Login failures
 sidebar_label: 403 IP Address Blocked
 tags: [kb, troubleshooting-and-errors]
-title: "Rolling-Log Fix: Hub Connection Failed. 403 Server Message: IP Address Blocked: Login Failures"
+title: "403 IP Address Blocked"
 knowledge_article_id: ka0Qk000000DlfRIAS
 products:
   - change-tracker
 ---
 
-# Rolling-Log Fix: Hub Connection Failed. 403 Server Message: IP Address Blocked: Login Failures
+# 403 IP Address Blocked
 
-## Symptoms
+## Symptom
 
 This problem can occur when the Agent password being sent to the Hub Server is incorrect.
 
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md b/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
index e543345f99..98e346d677 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/certificate-thumbprint-mismatch.md
@@ -7,13 +7,13 @@ keywords:
   - Hub Server
 sidebar_label: Certificate Thumbprint Mismatch
 tags: [kb, troubleshooting-and-errors]
-title: 'Rolling-Log Fix: "ERROR NNT.Hub.ServiceClient.HubAdapter - Certificate Thumbprint Does Not Match Trusted"'
+title: "Certificate Thumbprint Mismatch"
 knowledge_article_id: kA04u0000000JaGCAU
 products:
   - change-tracker
 ---
 
-# Rolling-Log Fix: "ERROR NNT.Hub.ServiceClient.HubAdapter - Certificate Thumbprint Does Not Match Trusted"
+# Certificate Thumbprint Mismatch
 
 ## Symptom
 

From 66a65c2291e386d98934f81b5f57f44d4f315bb6 Mon Sep 17 00:00:00 2001
From: hilram7 <212961752+hilram7@users.noreply.github.com>
Date: Mon, 8 Jun 2026 17:19:46 -0400
Subject: [PATCH 7/7] fix(kb): apply review fixes to Change Tracker batch 1 KB
 articles

- Fix product name second-mention violations across 13 articles (use short form "Change Tracker" after first "Netwrix Change Tracker" mention)
- Fix first-mention violation in exporting-more-than-50k-events (restore full product name)
- Change non-gerund titles to gerund form for antivirus-exclusions, in-transit-and-at-rest-data-encryption, and special-characters-in-passwords
- Complete incomplete instructions in configuring-fast (add step 7) and setting-up-siem-integration (add save step)
- Align sidebar_label to title in resubmitting-a-group-of-unplanned-changes
- Rename resubmit-a-group-of-unplanned-changes.md to resubmitting-a-group-of-unplanned-changes.md
---
 .../antivirus-exclusions-for-netwrix-change-tracker.md    | 8 ++++----
 .../configuration-and-setup/configuring-fast.md           | 3 ++-
 .../exporting-more-than-50k-events.md                     | 2 +-
 .../in-transit-and-at-rest-data-encryption.md             | 8 ++++----
 .../preventing-default-group-recreation.md                | 2 +-
 .../re-registering-a-deleted-device.md                    | 4 ++--
 ...es.md => resubmitting-a-group-of-unplanned-changes.md} | 2 +-
 .../setting-up-siem-integration.md                        | 5 +++--
 .../special-characters-in-passwords.md                    | 6 +++---
 .../uninstalling-the-agent-via-powershell.md              | 2 +-
 .../agent-does-not-run-on-rhel-8-or-9.md                  | 4 ++--
 ...or-503-unable-to-access-change-tracker-login-screen.md | 2 +-
 .../event-counts-summary-size-error.md                    | 4 ++--
 .../file-is-being-used-by-another-process-error.md        | 4 ++--
 .../pages-in-report-exceed-250-error.md                   | 2 +-
 15 files changed, 30 insertions(+), 28 deletions(-)
 rename docs/kb/changetracker/configuration-and-setup/{resubmit-a-group-of-unplanned-changes.md => resubmitting-a-group-of-unplanned-changes.md} (96%)

diff --git a/docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md b/docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md
index 89541f5544..747f90bea2 100644
--- a/docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md
+++ b/docs/kb/changetracker/configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md
@@ -21,11 +21,11 @@ sidebar_label: Antivirus Exclusions
 tags:
   - kb
   - configuration-and-setup
-title: Antivirus Exclusions for Netwrix Change Tracker
+title: Adding Antivirus Exclusions for Netwrix Change Tracker
 knowledge_article_id: ""
 ---
 
-# Antivirus Exclusions for Netwrix Change Tracker
+# Adding Antivirus Exclusions for Netwrix Change Tracker
 
 ## Overview
 
@@ -33,7 +33,7 @@ Antivirus (AV) and endpoint detection and response (EDR) solutions may negativel
 
 ## Instructions
 
-### Exclusions for Netwrix Change Tracker Agents
+### Exclusions for Change Tracker Agents
 
 | Name/Platform | Service | Process | Folder |
 |---|---|---|---|
@@ -41,7 +41,7 @@ Antivirus (AV) and endpoint detection and response (EDR) solutions may negativel
 | Linux NetCore Agent | `nntgen7agentcore` | `/opt/nnt/gen7agentcore/bin/Gen7Agent.App.NetCore` | - `/var/nnt/gen7agent.app.netcore/`<br />- `/opt/nnt/gen7agentcore/` |
 | Linux Express Agent | `nntexpressagent` | `/opt/nnt/expressagent/expressAgent` | - `/var/nnt/expressagent/`<br />- `/opt/nnt/expressagent/` |
 
-### Exclusions for Netwrix Change Tracker Hub
+### Exclusions for Change Tracker Hub
 
 | Service | Process | Folder |
 |---|---|---|
diff --git a/docs/kb/changetracker/configuration-and-setup/configuring-fast.md b/docs/kb/changetracker/configuration-and-setup/configuring-fast.md
index c940f64d1d..7bd83123e9 100644
--- a/docs/kb/changetracker/configuration-and-setup/configuring-fast.md
+++ b/docs/kb/changetracker/configuration-and-setup/configuring-fast.md
@@ -32,9 +32,10 @@ File Approved Safe Technology (FAST) automatically reconciles known-good file ch
 
 ## Instructions
 
-1. Log in to the Netwrix Change Tracker web console with an admin account.
+1. Log in to the Change Tracker web console with an admin account.
 2. Navigate to the **Planned Changes** page.
 3. Select **Actions** > **Planned Change Wizard** > **Create a new Planned Change Rule set**.
 4. Click **Add Planned Change Rule**. In the new window, select **FAST Match** in the **Enter rule details or apply standard rule settings** dropdown list.
 5. Click **Update**.
 6. Allow **All Groups** to be tracked, and check both **No Start, Continuous** and **No End, Continuous** checkboxes.
+7. Click **Finish** to save the planned change rule set.
diff --git a/docs/kb/changetracker/configuration-and-setup/exporting-more-than-50k-events.md b/docs/kb/changetracker/configuration-and-setup/exporting-more-than-50k-events.md
index 62ee3bff6a..24ca09e8d0 100644
--- a/docs/kb/changetracker/configuration-and-setup/exporting-more-than-50k-events.md
+++ b/docs/kb/changetracker/configuration-and-setup/exporting-more-than-50k-events.md
@@ -29,7 +29,7 @@ knowledge_article_id: ""
 
 ## Overview
 
-When the Events page contains more than 50,000 events, Change Tracker disables the export button. Use the **Export and Import** feature in Settings to export large event sets.
+When the Events page contains more than 50,000 events, Netwrix Change Tracker disables the export button. Use the **Export and Import** feature in Settings to export large event sets.
 
 ## Instructions
 
diff --git a/docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md b/docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md
index dff7d008b2..0a4ac2d9f7 100644
--- a/docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md
+++ b/docs/kb/changetracker/configuration-and-setup/in-transit-and-at-rest-data-encryption.md
@@ -20,11 +20,11 @@ sidebar_label: In-Transit and At-Rest Data Encryption
 tags:
   - kb
   - configuration-and-setup
-title: In-Transit and At-Rest Data Encryption
+title: Configuring In-Transit and At-Rest Data Encryption
 knowledge_article_id: ""
 ---
 
-# In-Transit and At-Rest Data Encryption
+# Configuring In-Transit and At-Rest Data Encryption
 
 ## Overview
 
@@ -34,10 +34,10 @@ This article covers the supported encryption options for Netwrix Change Tracker
 
 ### In-Transit Encryption
 
-Netwrix Change Tracker supports Transport Layer Security (TLS) protocol version 1.3 and earlier for in-transit data encryption. Disable nontarget protocol versions in your environment to ensure you use the intended TLS version.
+Change Tracker supports Transport Layer Security (TLS) protocol version 1.3 and earlier for in-transit data encryption. Disable nontarget protocol versions in your environment to ensure you use the intended TLS version.
 
 ### At-Rest Encryption
 
-MongoDB Community Edition, which is included in the Netwrix Change Tracker installation wizard, does not support at-rest data encryption. This feature is available in MongoDB Enterprise only. For details, see [MongoDB Encryption At-Rest](https://www.mongodb.com/docs/manual/core/security-encryption-at-rest/).
+MongoDB Community Edition, which is included in the Change Tracker installation wizard, does not support at-rest data encryption. This feature is available in MongoDB Enterprise only. For details, see [MongoDB Encryption At-Rest](https://www.mongodb.com/docs/manual/core/security-encryption-at-rest/).
 
 > **IMPORTANT:** The ASP.NET Core data protection API encrypts data such as user accounts, passwords, and network device credentials by default. Both MongoDB Community and Enterprise editions encrypt this type of data.
diff --git a/docs/kb/changetracker/configuration-and-setup/preventing-default-group-recreation.md b/docs/kb/changetracker/configuration-and-setup/preventing-default-group-recreation.md
index e47fb46e66..61f945a47b 100644
--- a/docs/kb/changetracker/configuration-and-setup/preventing-default-group-recreation.md
+++ b/docs/kb/changetracker/configuration-and-setup/preventing-default-group-recreation.md
@@ -34,7 +34,7 @@ The Netwrix Change Tracker console recreates default groups and their attached c
 
 To prevent default groups from being recreated:
 
-1. Log in to Netwrix Change Tracker.
+1. Log in to Change Tracker.
 2. Navigate to **Settings** > **System Settings**.
 3. Click **Show Advanced Options**.
 4. Click **Add Config Item**.
diff --git a/docs/kb/changetracker/configuration-and-setup/re-registering-a-deleted-device.md b/docs/kb/changetracker/configuration-and-setup/re-registering-a-deleted-device.md
index 08fff43734..b9729d9ba2 100644
--- a/docs/kb/changetracker/configuration-and-setup/re-registering-a-deleted-device.md
+++ b/docs/kb/changetracker/configuration-and-setup/re-registering-a-deleted-device.md
@@ -32,10 +32,10 @@ This article describes how to re-register a device that you previously deleted f
 
 ## Instructions
 
-1. Log in to the Netwrix Change Tracker console.
+1. Log in to the Change Tracker console.
 2. Navigate to **Settings** > **Agents & Devices**.
 3. Change the filter in the top-left corner to **[No Group Filter]**.
 4. The deleted devices are now visible in the **Agents & Devices** page with a **Re-Register** option.
 5. Click **Re-Register** next to the device to restore it.
 
-The device should now appear online in the Netwrix Change Tracker console.
+The device should now appear online in the Change Tracker console.
diff --git a/docs/kb/changetracker/configuration-and-setup/resubmit-a-group-of-unplanned-changes.md b/docs/kb/changetracker/configuration-and-setup/resubmitting-a-group-of-unplanned-changes.md
similarity index 96%
rename from docs/kb/changetracker/configuration-and-setup/resubmit-a-group-of-unplanned-changes.md
rename to docs/kb/changetracker/configuration-and-setup/resubmitting-a-group-of-unplanned-changes.md
index 7f8d3fe5df..5578121e9a 100644
--- a/docs/kb/changetracker/configuration-and-setup/resubmit-a-group-of-unplanned-changes.md
+++ b/docs/kb/changetracker/configuration-and-setup/resubmitting-a-group-of-unplanned-changes.md
@@ -16,7 +16,7 @@ keywords:
   - event resubmission
 products:
   - change-tracker
-sidebar_label: Resubmitting Unplanned Changes in Bulk
+sidebar_label: Resubmitting Unplanned Changes
 tags:
   - kb
   - configuration-and-setup
diff --git a/docs/kb/changetracker/configuration-and-setup/setting-up-siem-integration.md b/docs/kb/changetracker/configuration-and-setup/setting-up-siem-integration.md
index ccdb72fa43..87fe96cb3b 100644
--- a/docs/kb/changetracker/configuration-and-setup/setting-up-siem-integration.md
+++ b/docs/kb/changetracker/configuration-and-setup/setting-up-siem-integration.md
@@ -33,7 +33,7 @@ You can forward Netwrix Change Tracker events to a Security Information and Even
 
 ### Configuring the Syslog Server
 
-1. In the Netwrix Change Tracker console, navigate to **Settings** > **System Settings**.
+1. In the Change Tracker console, navigate to **Settings** > **System Settings**.
 2. Configure the **Syslog Server** settings according to your SIEM server's requirements:
    - Set the syslog version to one that your SIEM supports, or to Common Event Format (CEF).
    - Specify a UDP port for common default settings.
@@ -43,5 +43,6 @@ You can forward Netwrix Change Tracker events to a Security Information and Even
 
 Once the syslog server is configured, set up alerts to forward specific events to your SIEM:
 
-1. In the Netwrix Change Tracker console, navigate to **Settings** > **User Notifications**.
+1. In the Change Tracker console, navigate to **Settings** > **User Notifications**.
 2. Configure the specific event types to send to your SIEM, such as Device Offline, Unplanned Changes, and others.
+3. Click **Save** to apply the notification settings.
diff --git a/docs/kb/changetracker/configuration-and-setup/special-characters-in-passwords.md b/docs/kb/changetracker/configuration-and-setup/special-characters-in-passwords.md
index eb9964aac7..602605e39b 100644
--- a/docs/kb/changetracker/configuration-and-setup/special-characters-in-passwords.md
+++ b/docs/kb/changetracker/configuration-and-setup/special-characters-in-passwords.md
@@ -20,11 +20,11 @@ sidebar_label: Special Characters in Passwords
 tags:
   - kb
   - configuration-and-setup
-title: Supported Special Characters for User and Agent Passwords
+title: Using Special Characters in Passwords
 knowledge_article_id: ""
 ---
 
-# Supported Special Characters for User and Agent Passwords
+# Using Special Characters in Passwords
 
 ## Overview
 
@@ -42,4 +42,4 @@ When creating passwords that include special characters, use only the characters
 
 ### Configuring Local Password Requirements
 
-If you cannot integrate Netwrix Change Tracker with your Active Directory server, configure local user password requirements through **Settings** > **System Settings**, under the **User Password Settings** heading.
+If you cannot integrate Change Tracker with your Active Directory server, configure local user password requirements through **Settings** > **System Settings**, under the **User Password Settings** heading.
diff --git a/docs/kb/changetracker/configuration-and-setup/uninstalling-the-agent-via-powershell.md b/docs/kb/changetracker/configuration-and-setup/uninstalling-the-agent-via-powershell.md
index b756169f5c..d049906ba2 100644
--- a/docs/kb/changetracker/configuration-and-setup/uninstalling-the-agent-via-powershell.md
+++ b/docs/kb/changetracker/configuration-and-setup/uninstalling-the-agent-via-powershell.md
@@ -43,4 +43,4 @@ Run the following command:
 .\unins000.exe /SP-- /VERYSILENT /SUPPRESSMSGBOXES
 ```
 
-> **NOTE:** Netwrix Change Tracker does not have a built-in silent uninstall feature. This method uses the installer's silent mode switches.
+> **NOTE:** Change Tracker does not have a built-in silent uninstall feature. This method uses the installer's silent mode switches.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/agent-does-not-run-on-rhel-8-or-9.md b/docs/kb/changetracker/troubleshooting-and-errors/agent-does-not-run-on-rhel-8-or-9.md
index 2826260988..2038e99c38 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/agent-does-not-run-on-rhel-8-or-9.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/agent-does-not-run-on-rhel-8-or-9.md
@@ -42,7 +42,7 @@ The id for this license is '<id>'
 
 ## Cause
 
-The Netwrix Change Tracker agent cannot run due to cryptographic policy changes that Red Hat Enterprise Linux (RHEL) 8 or 9 applies by default.
+The Change Tracker agent cannot run due to cryptographic policy changes that Red Hat Enterprise Linux (RHEL) 8 or 9 applies by default.
 
 ## Resolution
 
@@ -77,4 +77,4 @@ The Netwrix Change Tracker agent cannot run due to cryptographic policy changes
 
 5. Reboot the RHEL system hosting the agent.
 
-The Netwrix Change Tracker agent should run after you apply the subpolicies.
+The Change Tracker agent should run after you apply the subpolicies.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md b/docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md
index 30f208dbbd..e1ec76ab7a 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/error-503-unable-to-access-change-tracker-login-screen.md
@@ -38,7 +38,7 @@ Server unavailable since <datestamp> (local),
 
 ## Cause
 
-The Netwrix Change Tracker web application pool is not running. The application pool may fail to start if the custom **Identity** user has incorrect credentials.
+The Change Tracker web application pool is not running. The application pool may fail to start if the custom **Identity** user has incorrect credentials.
 
 ## Resolution
 
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md b/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
index c40fcb0767..3cb825a768 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/event-counts-summary-size-error.md
@@ -40,11 +40,11 @@ The `EventStatsUnitSeconds` configuration item is not set to a factor of `86400`
 
 ## Resolution
 
-1. Log in to Netwrix Change Tracker.
+1. Log in to Change Tracker.
 2. Navigate to **Settings** > **System Settings**.
 3. Scroll to the bottom of the page and click **Show Advanced Options**.
 4. Under **Configuration Settings**, look for the description `EventStatsUnitSeconds`.
 5. If the config item does not exist, click **Add Config Item** to create it.
 6. If the value is not set or is not `1800`, click the **Edit** button next to `EventStatsUnitSeconds` and change the value to `1800`.
 7. Click **Update**.
-8. Log out and log back in to Netwrix Change Tracker.
+8. Log out and log back in to Change Tracker.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error.md b/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error.md
index 27cb1de614..b9e452728b 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/file-is-being-used-by-another-process-error.md
@@ -38,9 +38,9 @@ The `<path_to_file>` may differ depending on the affected report. For example: `
 
 ## Cause
 
-An antivirus (AV) or endpoint detection and response (EDR) solution in the environment is conflicting with Netwrix Change Tracker.
+An antivirus (AV) or endpoint detection and response (EDR) solution in the environment is conflicting with Change Tracker.
 
 ## Resolution
 
 - Exclude the top-level folder of the affected path from the monitoring scope of your AV or EDR solution to prevent further conflicts. This applies to real-time scans and backups. For the example path above, exclude `C:\Windows\TEMP`.
-- Exclude Netwrix Change Tracker folders, services, and processes from the monitoring scope of your AV and EDR. Refer to [Antivirus Exclusions for Netwrix Change Tracker](../configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md) for additional information.
+- Exclude Change Tracker folders, services, and processes from the monitoring scope of your AV and EDR. Refer to [Antivirus Exclusions for Netwrix Change Tracker](../configuration-and-setup/antivirus-exclusions-for-netwrix-change-tracker.md) for additional information.
diff --git a/docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md b/docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md
index 3ef904fdfe..d81bdc40dd 100644
--- a/docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md
+++ b/docs/kb/changetracker/troubleshooting-and-errors/pages-in-report-exceed-250-error.md
@@ -44,7 +44,7 @@ The estimated page count for the report exceeds the predefined limit.
 
 Increase the maximum allowed page count:
 
-1. In Netwrix Change Tracker, navigate to **Settings** > **System Settings** > **Show Advanced Options**.
+1. In Change Tracker, navigate to **Settings** > **System Settings** > **Show Advanced Options**.
 2. In the **Configuration Settings** section, click **Add Config Item**. In the **Description** field, enter `MaxPagesInReport`. In the **Value** field, enter `2000`.
 
    > **NOTE:** You can enter any value to cover the required target page count. The value `2000` is used as an example.