Submit a ticketCall us

AnnouncementsChange Is Inevitable

Get valuable help when it comes to tracking and monitoring changes. SolarWinds® Server Configuration Monitor (SCM) is designed to help you: detect, track, and receive alerts when changes occur, correlate system performance against configuration changes, compare server and application configuration against custom baselines, and verify application and system changes.

Learn more.

Home > Success Center > Netflow Traffic Analyzer (NTA) > NTA - Knowledgebase Articles > NTA Collector Service and the Enhanced Mitigation Experience Toolkit

NTA Collector Service and the Enhanced Mitigation Experience Toolkit

Table of contents

Updated June 19, 2018


This article explains the effect that the Microsoft Enhanced Mitigation Experience Toolkit [EMET Service] has on the SolarWinds Netflow Collector Service.


  • NTA 4.X and newer


  • The EMET service does not allow the NTA Collector to update the keep alive status in the Orion database, and kills the update of the SolarWinds Netflow performance counters. This causes Netflow collection to stop and causes the NTA collector service to show Red or Down in the Netflow Settings and Netflow Events pages.
  • No SolarWinds or Windows Event logs will point to the EMET service being an issue as the Netflow Service will look to be running from the server or operating system perspective. You will only see the EMET process if Task Manager or Process Explorer is started when the Netflow Service performance counters initiate.
  • We've found in most cases it is not enough to disable or add exceptions to EMET. SolarWinds recommends uninstalling the toolkit from any server that has the Netflow Collector Service installed.


Last modified