The NTFS Security scan module captures the permission structure of a file
server: its shares and the rights granted on them. What is captured is defined
by an analysis package—a reusable compilation of server, shares, domain
and credentials.
Prerequisites
Ports and protocols
Permissions
The account is a domain user with read permissions on the complete file structure.
Network requirements
- The file system is NTFS or ReFS.
- The file system is not mapped as a network drive on the gateway’s computer.
The wizard
Domain and credentials are mandatory in the Authentication step. Unlike
Active Directory and Windows (AD), this scan does not run under the
gateway’s service account.
Choosing or building an analysis package
In the NTFS Configuration step you choose an existing analysis package or
put a new one together. To load the shares, the dialog needs a gateway and
credentials from the previous steps. Shares that the gateway reports as
administrative are marked Admin. Hidden shares appear at the end of the list;
when you create an analysis package, all shares found are preselected except
the hidden ones.
The analysis package is the fixed unit that every run scans again. Results of
later runs are only comparable as long as its scope stays the same.
An analysis package always carries exactly one server. For a second file
server, create a second analysis package.
Limit the folder depth if you only want to evaluate the upper levels of a
share at first. Leave the field empty and the job captures the full depth;
the permitted values are in the
Scan Reference. Selecting shares
If an analysis package stores no shares, every execution scans all shares of
the server—including those added later. The dialog reports this state with
“All shares of the server are scanned, including future ones.” If you clear a
share or enter one manually, the analysis package switches to a fixed list;
shares added later are then no longer scanned. The checkbox in the header row
of the list restores the “all” state.
When you edit an analysis package with a fixed list, newly found shares are
added cleared. Select them if the scan is to capture them. The analysis
data shows a changed selection only after the next execution.
Managing analysis packages
Under Scan › Analysis Packages you can also create an analysis package
independently of a job. In the dialog, choose the Gateway first. Only then
does the Credentials field also offer the credentials stored on that
gateway. If you change the gateway, the dialog clears such a selection again.
You can create missing credentials directly from the dialog; the only type
available there is User Account. Load Servers from Active Directory stays
disabled until credentials, gateway and domain are chosen.
The search for servers and shares can take a while. If you close the dialog
during the search, all input is lost after a confirmation.
Each entry in the list shows the number of jobs that use the analysis
package—including “0 Jobs”; expanded, it names those jobs under Used in Jobs.
The confirmation when deleting names the consequence, but does not check
whether the analysis package is actually used in any job. Expand the entry
beforehand to see that for yourself.
