permREADER

permREADER is a simple portable app for reading the permissions of file shares. Usually, the scan of a file share is also the starting point for file server optimization.

Starting from a file share, permREADER reads all folders and their permissions recursively and writes this information to a .csv file. Within the file you can analyze the individual permissions and the detailed information (inheritance, propagation …).

The app can simply be executed on a server or client with administrative authorizations, after which a console window opens,  in which a UNC share must be entered. The permREADER then scans the folder structures and their permissions and outputs them in a .csv file. Based on the scanned permissions, you can adapt the .csv file to your own requirements and then roll out the permissions using permWRITER.

permWRITER

permWRITER can be used to reassign permissions to file shares in accordance with current Microsoft best practices.

In a .csv file, you define the individual folders and the required permissions for individual user or group objects (e.g. folder “\\Server\Share\Departments\Purchasing” should receive a “Change” permission for the AD group “Purchasing”). The permWRITER then creates the required authorization group as well as the necessary list authorizations (these ensure that the members of the AD group “Purchasing” from the previous example are able to navigate to the folder “Purchasing”) in the Active Directory, nests the correct members in the created groups and writes the authorization groups to the folder in the ACL.

These features are inclued in permWRITER:

• Creation of the required Active Directory groups
• Creation of authorizations according to Microsoft best practices
• Creation of list authorizations on the first three folder levels (for deeper authorizations, the authorization group continues to be used as a list authorization so as not to affect the Kerberos token unnecessarily)
• Free definition of the group name scheme
• Free definition of the group type (global, domain local, universal)

The permWRITER supports various customization paths. The preferred path is usually the cleanup for a new, empty target share. This has the advantage that assigning authorizations is much faster. The application is also able to add new authorizations to existing shares. However, the old authorizations on the existing share must then be cleaned up using permREMOVER.Die mit dem permWRITER erstellten Berechtigungen sind zu 100% kompatibel mit tenfold und können sofort darin übernommen werden.

The permissions created with permWRITER are 100% compatible with tenfold and can be used immediately.

permREMOVER

With permREMOVER, the old authorizations can be removed after new authorizations have been assigned.

If you have decided against transferring your data to a new, empty target share and only want to change your permissions on the folders in accordance with Microsoft best practices, the old permissions must be removed after the new permissions have been assigned.

To do this, you only need to inform permREMOVER of a UNC share, which it then checks recursively for explicitly set permissions and removes them. A whitelist is taken into account, which you can use to control which of the permissions on the folders are retained.

These features are inclued in permREMOVER:

• Revocation of explicit permissions on a fileshare
• Whitelist for accounts that should not be removed