Security Explorer 9.9.2

Setting alternate credentials NAS devices

Use alternate credentials to specify additional accounts that have administrative privileges to various NAS devices on your network. Each account in the list is tried in the order listed until an account is found with sufficient privileges. If no account is found with administrative privileges, Access Denied is displayed.


	NOTE: For some NAS devices, Security Explorer may require that you explicitly provide credentials, because Security Explorer uses Secure Shell (SSH) connections for certain actions.

To set alternate credentials for NAS devices

Choose Tools | Options, and open the NAS Devices tab.

To add alternate credentials:

Click Add.

Type an account name, or browse to select an account.

Type the password.

Type a computer name (optional).


	NOTE: Security Explorer recognizes NAS devices by computer name, so it is beneficial to identify the device by entering a computer name.

Click OK.

Use the buttons to manage alternate credentials.

•

To modify the selected alternative credential, click Edit.

•

To delete the selected alternative credentials, click Del.

•

To clear the list of alternative credentials, click Clear.

Click OK.

Setting advanced options

To set advanced options

Select Tools | Options, and open the Advanced tab.

Set options for domains and computers.

Table 10. Domain and computer options
Option	Description
Load domains using Active Directory	Select to load domains when you select items in the Navigation pane.
Load computers using Active Directory	By default, computers, groups, and users are loaded when you select items in the Navigation pane.
Include unknown computers when browsing/searching domains	To activate this check box, clear the Load computers, groups and users using Active Directory check box. Select to include unknown computers in the Navigation pane.
Highlight domain controllers when browsing domains	By default, an icon displays next to domain controllers.
Highlight workstations and servers when browsing domains	By default, servers and workstations are identified by different icons. If you clear this check box, both servers and workstations are identified by the same icon.
Auto-detect computers which are members of a cluster	Select to automatically select the Show Cluster File Shares check box when browsing computers that are members of a cluster. If selected, a warning message displays when you click OK. Click Yes to verify the selection. See Viewing permissions.
Check connection before loading (Ping)	Select to ping computers before loading. If a computer is unavailable, a warning message appears. The default time-out is set to 1,500 ms. By default, Security Explorer does not check the connection, which could cause a response delay if that computer is unavailable.

Set options for modifying permissions (NTFS).

Table 11. Modifying Permissions (NTFS) options
Option	Description
Do not set ‘Archive’ attribute when setting security	By default, the Archive attribute is set to Archive when a change is made to a permission. Select to leave the Archive attribute set to Normal if a change is made.
Skip reparse points when processing permission changes	By default, reparse points are skipped when processing permission changes.
Skip subfolders and files when processing This Folder Only permissions (Grant/Delete only)	By default, child items under the parent folder are processed when granting or deleting the This Folder Only permission. Select to skip processing child items when granting or deleting the This Folder Only permission, which may speed up the process. NOTE: If you choose to skip subfolder processing, any existing inheritance issues are not corrected automatically as part of the processing.

Set the thread count.

By default, up to 10 searches and some process operations can run concurrently. To change the number, type a value in the Thread Count box.

Set the options for the browsing cache.

Table 12. Saved Information and Browsing Cache options

Option

Description

Use cache when browsing

By default, if the user browses to a path, such as c:\windows, the contents of c:\windows is stored in either a display (stored in memory) or a persistent (stored in an SQLite database) cache and can be reloaded immediately. Clear the check box to disable the caches and always reload information from the original target.

Use persistent cache

By default, a persistent SQLite database cache is used to store and quickly display lists, even if the console has been restarted since the cache contents were loaded originally.

View indicator when items loaded from cache

By default, a C displays next to items loaded from the cache and CACHE displays in the status bar. The default size of the display cache is 25 entries. Clear the check box to remove the indicator from display.

Do not use cached entries older than

By default, the age of the cache entry is examined prior to loading a path. By default, entries older than 3 hours are reloaded from the disk. You can set the value in the Display cache box up to 24 hours and in the Persistent cache box up to 999 hours.

If the user revisits a path, the age of the cached entry is inspected to determine if the path is loaded from the cache or disk.

•

If the age of the cache entry is less (younger) than the values set in the Display cache and Persistent cache boxes, the entry is reloaded from the cache.

•

If the age of the cache entry is greater (older) than the values set in the Display cache and Persistent cache boxes, then the cache entry is removed and the entry is reloaded from disk.

Cache Reset All

Click to clear the database caches for all modules. Active only if the Use cache when browsing or Use persistent cache check boxes are selected.

Set the options for sharing saved information and changing the configuration settings load path.

You can choose to copy configuration information from the All Users account to your user account or copy your configuration information to the All Users account.


	NOTE: The Cache folder and the PersistantData.xml file are not shared in this process. IMPORTANT: Folders and files are overwritten in this process. You may want to make copies of your original files before starting this process.

By default, the configuration folders and files of a user are saved to C:\Users\<Current User>\AppData\
Local\Quest\Security Explorer\v9. You can choose to change the location where your configuration folders and files are stored.


	NOTE: The mapping between each user and their specified config load path is saved to the UserConfigSettings.xml file located at C:\ProgramData\Quest\Security Explorer\v9. When a user starts Security Explorer, this file is checked for a user-specific setting. If a specified config load path mapping is found, Security Explorer loads the configuration settings from the path specified in the UserConfigSettings.xml file. If a mapping is not found, Security Explorer uses the settings from the default path: C:\Users\<Current User>\AppData\Local\Quest\Security Explorer\v9.

Table 13. Configuration information
Folders and files saved	Description
PersistantData.xml	User settings
BackupSavedTasks.xml	List of scheduled backups
ExportSavedTasks.xml	List of scheduled exports
SavedAccessManagerServers.xml	List of Access Explorer servers (NTFS Security module only)
SavedPermissionTemplates.xml	Saved Permission Templates (NTFS Security module only)
SavedSharePointSites.xml	Saved SharePoint farms and sites (SharePoint Security module only)
SavedLocations.xml	Favorites and Enterprise Scopes
Saved Searches folder	Saved searches for all modules

To share configuration information and change the configuration load path

Click Advanced.

Select how to share configuration information.

•

To copy configuration information from the All Users account to your account, leave the Share information with all users check box blank, and click Copy Shared Data.

•

To copy your configuration information to the All Users account, select the Share information with all users check box, and click Copy User Specific Data.

By default, the configuration information of a user is saved to C:\Users\<Current User>\AppData\Local\Quest\Security Explorer\v9. To change the location, select the Change config load path check box, browse to select the new location, and click OK.

Click OK.

If you selected to change the config path, you are asked to confirm your selection. Click Yes to confirm.

Click OK.

Controlling access to Security Explorer

Use Security Explorer Role Based Management (SXPRoleBasedManagement.exe) to disable specific users from accessing a specific module. The module is hidden from the user.


	NOTE: You must be a Domain Administrator or have the necessary permissions to manage domain groups to apply the changes.

Usage

SXPRoleBasedManagement

Select a module, and click Add to add users to the list. Once you click Close, those users are prevented from accessing the selected module the next time they start Security Explorer.


	NOTE: The first time you use this command, a message box displays. Security Explorer must create a global domain group for each module, such as SXP_NTFS_Disabled. Once the groups are created, you can add users manually to these groups to prevent module access. See Modifying group memberships.

Using the command line

Security Explorer® includes support for command line usage through separate programs that were copied to your install directory during the installation process. In addition, Security Explorer supports cmdlets for use with Windows PowerShell®.


	IMPORTANT: All command utilities should be run while logged on as an Administrator. The Security Explorer cmdlets must be run as an administrator with elevated privileges (if UAC is enabled).

Topics:

•

Opening a command prompt window

•

•

•

•

•