Security Explorer 9.9

Using the Grant task

The Grant task provides a quick way to grant permissions. For more options, add at least one path, and click Switch to Security Explorer Classic (Advanced). See Using the Browse tab to grant permissions.


	NOTE: The Tasks tab is hidden by default. To display the Tasks tab, select View \| Tasks tab.

To grant permissions using the Grant task

Open the module for the type of permission you want to grant.

Open the Tasks tab, and click Grant.

Click Add to select paths.

Click Add to select permissions.

To include objects that do not inherit permissions from the parent object, select the check box.

Click OK. The Granting Permissions box displays the progress. See Completing a process.

Revoking permissions

You can revoke access for users and groups. The type of permission revoked depends on the selected module. For example, if you want to revoke permissions for a printer, open the Printer Security module.

In the NTFS Security module, you can create a schedule to temporarily revoke a permission.


	NOTE: For NetApp Clustered mode, to see changes after a permission action on folders and shares, you must refresh the tree in the Navigation pane. NOTE: To customize the revoke process in the NTFS module, you can set options for modifying permissions. See Setting advanced options.

Topics:

•

Using the Browse tab to revoke permissions

•

Revoking permissions on unknown accounts

•

Revoking permissions on disabled accounts

•

Using the Revoke tasks

Using the Browse tab to revoke permissions

To revoke permissions using the Browse tab

Open the module for the type of permission you want to revoke.

Open the Browse tab.

Select an item in the Navigation pane.

–OR-

Type a path in the Path box, and click Go.

Select an object in the Objects pane or a permission in the Permissions pane.

Select Security | Revoke Permissions.

–OR-

Click

on the Tool Bar; click Revoke on the Control Buttons Bar; or right-click the object or permission, and choose Revoke Permissions.

The Revoke Folder Permissions dialog box displays the path, and the associated groups and users for the current object. The navigation tree is hidden by default. To view the navigation tree, click 4.

Select the groups and users to revoke the permission. There are a few methods for selecting groups and users.

•

Choose from the list of local and domain groups and users in the navigation tree.

•

To filter the list in the left pane, type a server name or base path in the box, and click Set.

•

To return the full list to view, click Reset. The list returns to full view the next time you open Revoke Permissions.

•

Select from the list of groups and users associated with the current object.

•

To change to another domain or to the local computer, select the domain or the local computer from the List Names From list.

•

To display users in the list, click Show Users. To return the list to show only groups, click Refresh.

•

To select a group/user not displayed, type a name or click Advanced User Selection.

•

Browse for a group or user.

From the Permission list, select the permissions to revoke, and whether or not to Allow or Deny. If the choice is not available in the list, click Advanced Permission Selection to create a custom choice.

To add the group/user to the List of users and groups to revoke list, click Add.


	TIP: To add additional groups or users to the List of users and groups to grant list with the selected permission settings, you can hold down CTRL or SHIFT, and click a group or user from the list or double-click a group or user in the navigation tree.

Choose options.

Table 2. Revoke options
Option	Description
Revoke all permissions (Allow and Deny) for the selected user	Not available in the Task Management and Groups and Users modules. Select to revoke all permissions (Allow and Deny) for the selected user.
Include SID history search when adding permissions for revoking	Select to invoke a SID history search when you click Add to add the selected group/user to the List of users and groups to revoke list. Since there may be more than one SID associated with the selected account, selecting this check box adds all existing SIDs to the List of users and groups to revoke list so that all existing permissions are revoked.
Advanced Revoke Options	If you select this check box, a warning message displays and the Revoke Folder Permissions dialog box becomes inactive, so the other users/groups and permissions you selected are not included in this action. To continue, click Yes.
Revoke all unknown and deleted accounts	Select to revoke permissions on unknown or deleted accounts.
Revoke all disabled accounts	Select to revoke permissions on all disabled accounts.
Log Actions	Select to create a log file. Browse to name the log file.
Include protected objects (objects with ‘Inherit Permissions from Parent’ disabled)	Select to revoke permissions on protected objects.