---
title: "What Share permissions are required for NTFS?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-share-permissions-are-required"
language: "en"
last_updated: "2026-05-28T22:43:55.071Z"
---

# What Share permissions are required for NTFS?

For a Spirion scan to succeed on a network share, you must configure permissions in 2 different places: the Share Permissions and the NTFS (Security) Permissions.

Windows uses the **"Most Restrictive"** logic—if the Share permission is "Read" but the NTFS permission is "Full Control," the agent will only have "Read" access.

## 1\. Share Permissions (The "Entry Gate")

These are configured on the "Sharing" tab of the folder properties.

-   **For Discovery Only:** Set the Service Account to **Read**.
-   **For Classification & Remediation:** Set the Service Account to **Change**.
-   -   *Note:* "Change" is required for the agent to write metadata (NTFS ADS) or move/delete files (Quarantine/Shred). "Full Control" is generally not necessary at the Share level.

* * *

## 2\. NTFS Permissions (The "File Level")

These are configured on the "Security" tab. These permissions are more granular and should be set based on what your **Scan Playbook** is designed to do.

| If your Playbook does... | Required NTFS Permissions |
| --- | --- |
| **Discovery / Search Only** | Read & Execute, List Folder Contents, Read |
| **NTFS Classification (ADS)** | All of the above **PLUS** Write Attributes |
| **Quarantine (Move)** | All of the above **PLUS** Modify and Delete (on Source) and Write (on Destination) |
| **Shred / Redact** | All of the above **PLUS** Modify and Delete |

* * *

## 3\. Permission Requirements by Action Type

### Discovery (Search)

The agent needs to be able to "walk" the directory tree and open files.

-   **List Folder Contents:** To see what files exist.
-   **Read:** To open the file and inspect the content for sensitive data.
-   **Read Attributes:** To check "Last Modified" dates for Search History optimization.

### Classification (Tagging)

If you are using **NTFS Alternate Data Streams (ADS)** to label files:

-   **Write Attributes:** This is the specific permission that allows Spirion to write the "Confidential" or "GDPR" tag into the file's metadata without changing the file's primary content.

### Remediation (Quarantine/Shred)

-   **Modify:** Required to change the file or its location.
-   **Delete:** Required to remove the file from the original location after it has been moved to Quarantine, or to Shred it entirely.

* * *

## Best Practices for Share Permissions

1.  **Use a Dedicated Service Account:** Never use a Domain Admin account for scanning. Create a service account (e.g., `svc-spirion-scanner`) and grant it only the permissions it needs.
2.  **Check the Destination:** If your Playbook uses **Quarantine**, the service account must have **Write/Modify** permissions on the *destination* folder (the "Vault"), or the move action will fail even if the source permissions are correct.
3.  **Avoid "Everyone":** Do not grant permissions to "Everyone." Explicitly add the Spirion Service Account to the ACLs.
4.  **UNC Paths Only:** When configuring the scan in the Spirion Console, always use the **UNC path** (e.g., `\\Server\Share\Data`). The agent runs as a service and cannot see mapped drives (like `S:\`) created by a user.

## Summary

For a full-featured scan (Discovery + Classification), the Service Account needs **Change** at the Share level and **Read/Write Attributes** at the NTFS level.