Skip to main content
The NTFS Security scan module captures the permission structure of a file server: its shares and the rights granted on them. What is captured is defined by an analysis package—a reusable compilation of server, shares, domain and credentials.
This module captures the data. The permissions themselves are evaluated under Analysis › File System.

​
Prerequisites

​
Ports and protocols

​
Permissions

The account is a domain user with read permissions on the complete file structure.

​
Network requirements

  • The file system is NTFS or ReFS.
  • The file system is not mapped as a network drive on the gateway’s computer.

​
The wizard

Domain and credentials are mandatory in the Authentication step. Unlike Active Directory and Windows (AD), this scan does not run under the gateway’s service account.

​
Choosing or building an analysis package

In the NTFS Configuration step you choose an existing analysis package or put a new one together. To load the shares, the dialog needs a gateway and credentials from the previous steps. Shares that the gateway reports as administrative are marked Admin, hidden shares Hidden. Hidden shares appear at the end of the list; when you create an analysis package, all shares found are preselected except the hidden ones. The analysis package is the fixed unit that every run scans again. Results of later runs are only comparable as long as its scope stays the same.
An analysis package always carries exactly one server. For a second file server, create a second analysis package.
Limit the folder depth if you only want to evaluate the upper levels of a share at first. Leave the field empty and the job captures the full depth; the permitted values are in the Scan Reference.
The new analysis package is created only after the wizard is completed, and is then available under Scan › Analysis Packages for further jobs.

​
Selecting shares

If an analysis package stores no shares, every execution scans all shares of the server—including those added later. The dialog reports this state with “All shares of the server are scanned, including future ones.” If you clear a share or enter one manually, the analysis package switches to a fixed list; shares added later are then no longer scanned. The checkbox in the header row of the list restores the “all” state.
When you edit an analysis package with a fixed list, newly found shares are added cleared. Select them if the scan is to capture them. The analysis data shows a changed selection only after the next execution.

​
Managing analysis packages

Under Scan › Analysis Packages you can also create an analysis package independently of a job. In the dialog, choose the Gateway first. Only then does the Credentials field also offer the credentials stored on that gateway. If you change the gateway, the dialog clears such a selection again. You can create missing credentials directly from the dialog; the only type available there is User Account. Load Servers from Active Directory stays disabled until credentials, gateway and domain are chosen. The search for servers and shares can take a while. If you close the dialog during the search, all input is lost after a confirmation. Each entry in the list shows the number of jobs that use the analysis package—including “0 Jobs”; expanded, it names those jobs under Used in Jobs.
The confirmation when deleting names the consequence, but does not check whether the analysis package is actually used in any job. Expand the entry beforehand to see that for yourself.
Which type this scan produces is under Storage, Backup, Permissions and Directory and Network Services.