What Share permissions are required for NTFS?
Windows uses the "Most Restrictive" logic—if the Share permission is "Read" but the NTFS permission is "Full Control," the agent will only have "Read" access.
1. Share Permissions (The "Entry Gate")
These are configured on the "Sharing" tab of the folder properties.
- For Discovery Only: Set the Service Account to Read.
- For Classification & Remediation: Set the Service Account to Change.
- Note: "Change" is required for the agent to write metadata (NTFS ADS) or move/delete files (Quarantine/Shred). "Full Control" is generally not necessary at the Share level.
2. NTFS Permissions (The "File Level")
These are configured on the "Security" tab. These permissions are more granular and should be set based on what your Scan Playbook is designed to do.
If your Playbook does... | Required NTFS Permissions |
|---|---|
Discovery / Search Only | Read & Execute, List Folder Contents, Read |
NTFS Classification (ADS) | All of the above PLUS Write Attributes |
Quarantine (Move) | All of the above PLUS Modify and Delete (on Source) and Write (on Destination) |
Shred / Redact | All of the above PLUS Modify and Delete |
3. Permission Requirements by Action Type
Discovery (Search)
The agent needs to be able to "walk" the directory tree and open files.
- List Folder Contents: To see what files exist.
- Read: To open the file and inspect the content for sensitive data.
- Read Attributes: To check "Last Modified" dates for Search History optimization.
Classification (Tagging)
If you are using NTFS Alternate Data Streams (ADS) to label files:
- Write Attributes: This is the specific permission that allows Spirion to write the "Confidential" or "GDPR" tag into the file's metadata without changing the file's primary content.
Remediation (Quarantine/Shred)
- Modify: Required to change the file or its location.
- Delete: Required to remove the file from the original location after it has been moved to Quarantine, or to Shred it entirely.
Best Practices for Share Permissions
- Use a Dedicated Service Account: Never use a Domain Admin account for scanning. Create a service account (e.g.,
svc-spirion-scanner) and grant it only the permissions it needs. - Check the Destination: If your Playbook uses Quarantine, the service account must have Write/Modify permissions on the destination folder (the "Vault"), or the move action will fail even if the source permissions are correct.
- Avoid "Everyone": Do not grant permissions to "Everyone." Explicitly add the Spirion Service Account to the ACLs.
- UNC Paths Only: When configuring the scan in the Spirion Console, always use the UNC path (e.g.,
\\Server\Share\Data). The agent runs as a service and cannot see mapped drives (likeS:\) created by a user.
Summary
For a full-featured scan (Discovery + Classification), the Service Account needs Change at the Share level and Read/Write Attributes at the NTFS level.