What Permissions does the Agent need for NTFS Classification?

Because Spirion is a security tool, the "Principle of Least Privilege" is recommended. Here is the breakdown of required permissions:

1. For Scanning (Discovery & Search)

To find sensitive data, the Agent must be able to open and read the content of files.

• Read & Execute: Required to traverse directories and open files.
• Read Attributes / Read Extended Attributes: Required to see file metadata (like "Last Modified" dates) which is used for Search History optimization.
• List Folder Contents: Required to enumerate the files within a directory.

2. For NTFS Classification (ADS)

If you are using the NTFS Alternate Data Stream method to label files, the Agent needs slightly elevated permissions:

• Write Attributes / Write Extended Attributes: This is the specific permission required to write the metadata "tag" to the file without changing the primary content.
• Note: This is generally safer than "Full Modify" because it doesn't allow the Agent to change the actual text inside the document.

3. For Strong Remediation (Quarantine, Shred, Redact)

If your Playbook includes destructive or movement-based actions, the Agent needs higher authority:

• Modify: Required to Redact (change the content) or Quarantine (move the file and delete the original).
• Delete: Specifically required for Shred or Delete actions.
• Write: Required to create the new file in the Quarantine destination folder.

4. Service Account Requirements (By Target Type)

The "identity" the Agent uses depends on the Target:

• Local Windows Agent: Typically runs as the SYSTEM account. This usually has all necessary permissions by default, but in hardened environments, you must ensure SYSTEM hasn't been restricted from specific data volumes.
• Remote File Shares (SMB/CIFS): The scan must be configured with a Service Account. This account needs the permissions listed above on the NTFS Security tab AND "Change" permissions on the Share tab.
• Databases (SQL, Oracle, etc.): The database user provided in the scan configuration needs SELECT permissions on the tables/schemas you wish to scan.

Permission Summary Table

Troubleshooting Tip: "Access Denied"

If you see a scan status of "Done, With Results, Errors" and the error log shows "Access Denied," check these three things:

1. Inheritance: Ensure the service account is inheriting permissions down to the sub-folders.
2. Share vs. NTFS: Remember that for network shares, the most restrictive permission wins. If the Share permission is "Read" but NTFS is "Modify," the Agent will only be able to Read.
3. Locked Files: Sometimes "Access Denied" is actually a "File in Use" error. Spirion will retry, but if a file is exclusively locked by another application (like a database log), the Agent cannot read it.

Summary

For basic discovery and classification, the Agent needs Read and Write Attributes. For full remediation, it needs Modify and Delete.