Getting Started with Security Explorer
Starting Security Explorer
Customizing the view
Managing permissions
Choosing an interface mode
Using the Tasks tab
Using the status bar
Using the loading progress bar
Managing module buttons
Completing a process
Viewing permissions
Granting permissions
Revoking permissions
Searching
Using the Browse tab to revoke permissions
Revoking permissions on unknown accounts
Revoking permissions on disabled accounts
Using the Revoke tasks
Cloning permissions
Using the Browse tab to clone permissions
Creating permission templates
Copying permissions
Copying permissions to subfolders and files
Setting ownership
Modifying permissions
Reducing permissions to read only
Managing group memberships
Renaming accounts
Deleting permissions
Printing permissions
Selecting users and groups manually
Selecting users and groups automatically
Updating permissions relating to a user's SID history
Importing users and groups
Using the Clone task
Using the Browse tab to search
Managing saved searches
Adding a search scope
Setting search criteria
Managing security
Group and user search criteria
Permission search criteria
Folder and file search criteria
Service and task search criteria
Group and user search criteria
Advanced search options
Registry key search criteria
Using the Search tasks
Replacing permissions
Scheduling a search
Managing search tasks
Backing up security
Scheduling a backup
Using the backup scheduler
Restoring security
Comparing security
Purging backup files
Scheduling a backup purge
Exporting security
Managing objects
Using the Browse tab to export security
Using the Export task
Scheduling an export
Managing export tasks
Comparing backup files
Managing folders and files
Working with Microsoft SQL Server
Creating a new folder
Deleting a folder or file
Viewing folder and file properties
Showing open files
Opening files
Editing files
Opening a folder in Windows Explorer
Managing shares
Managing registry keys
Managing services
Starting, stopping, pausing, or restarting a service
Setting logon accounts
Changing the password for a logon account
Scheduling logon account password changes
Removing a service
Modifying service properties
Managing tasks
Running a task
Setting account information
Creating a new task
Copying a task
Exporting a task
Removing a task
Modifying task properties
Managing groups and users
Viewing accounts
Creating a new group
Creating a new user
Modifying group and user properties
Modifying group or user Active Directory properties
Modifying properties of multiple users
Modifying group memberships
Viewing group and user memberships
Changing user passwords
Modify memberships of multiple local groups
Clearing the local administrator group
Deleting groups and users
Creating a new Managed Service Account
Modifying Managed Service Account properties
Modifying Managed Service Account Active Directory properties
Viewing Managed Service Account memberships
Deleting Managed Service Account
Managing Favorites
Managing Enterprise Scopes
Creating an Enterprise Scope while browsing
Creating an Enterprise Scope
Editing an Enterprise Scope
Removing an Enterprise Scope
Updating licenses
Managing network drives
Viewing SQL Server permissions
Granting SQL Server permissions
Revoking SQL Server permissions
Cloning SQL Server permissions
Modifying SQL Server permissions
Searching for SQL Server objects and permissions
Backing up and restoring SQL Server security
Exporting SQL Server database permissions
Managing SQL Server objects
Working with Microsoft Exchange
Copying SQL Server objects
Copying SQL Server permissions
Managing SQL Server databases
Managing Security SQL Reporting Services
Setting options for SQL Server
Modifying SQL Server security settings
Managing SQL Server network settings
Adding a new database role
Removing a database role
Modifying a database role
Adding a new database user
Removing a database user
Modifying a database user
Adding a new schema
Removing a schema
Modifying a schema
Managing logins
Managing server roles
Checking minimum requirements
Viewing Exchange permissions
Granting Exchange permissions
Revoking Exchange permissions
Cloning Exchange permissions
Searching for Exchange server objects and permissions
Backing up and restoring Exchange server security
Modifying Exchange permissions
Managing Exchange group memberships
Exporting Exchange security permissions
Creating Exchange databases
Creating public folder mailboxes
Managing Exchange administrators
Managing Exchange distribution groups
Managing mail contacts
Managing mail users
Managing mailboxes
Managing mailbox folders
Working with Microsoft SharePoint
Creating mailbox folders
Managing permissions on mailbox folders for multiple users
Deleting mailbox folders
Managing public folders
Using role based access control
Managing user roles
Managing role groups
Managing roles
Setting options for Exchange security
Creating assignments
Modifying assignments
Deleting assignments
Creating child roles
Modifying child roles
Deleting child roles
Adding entities
Modifying entities
Deleting entities
Managing custom scopes
Using the SharePoint menu
Adding SharePoint farms or sites
Managing SharePoint farms or sites
Previewing SharePoint objects
Deploying the SharePoint web service
Deploying the SharePoint web service manually
Managing SharePoint permissions
Working with Access Explorer
Viewing SharePoint permissions
Granting SharePoint permissions
Revoking SharePoint permissions
Cloning SharePoint permissions
Modifying SharePoint permissions
Modifying SharePoint permissions levels
Repairing limited access permissions
Removing permissions on deleted accounts
Removing permissions on disabled accounts
Managing SharePoint groups
Removing accounts from SharePoint groups
Searching for SharePoint objects
Modifying SharePoint properties
Backing up and restoring SharePoint security
Exporting SharePoint permissions
Setting SharePoint options
Removing the SharePoint web service
Removing the SharePoint web service manually
Access Explorer components
Working with Microsoft Active Directory
Managed domain
Registered forest
Managed computer
Access Explorer agent
Scopes
Database
Service accounts
Setting up Access Explorer
Setting up the Access Explorer database
Setting up the first managed domain (includes the service account)
Updating Access Explorer configuration
Adding managed domains
Adding forests
Editing managed domains or forests
Adding service accounts
Editing service accounts
Deleting service accounts
Collecting Access Explorer data
Setting up a managed computer
Installing the Access Explorer agent locally
Installing the Access Explorer agent remotely
Managing managed computers
Modifying managed computer properties
Managing Access Explorer agents
Viewing Access Explorer objects
Searching Access Explorer servers
Using the Access Explorer permission wizard
Changing all permissions
Cloning all permissions
Deleting all permissions
Exporting all permissions
Backing up permissions
Setting options for Access Explorer
Viewing Active Directory permissions
Granting Active Directory permissions
Revoking Active Directory permissions
Cloning Active Directory permissions
Searching for Active Directory objects
Modifying Active Directory permissions
Modifying group memberships
Modifying Active Directory properties
Deleting Active Directory permissions
Backing up and restoring Active Directory security
Exporting Active Directory permissions
Setting options for Active Directory Security
Customizing Security Explorer
Setting general options
Setting view options
Setting alternate credentials for workgroups
Setting alternate credentials for services and tasks
Setting alternate credentials NAS devices
Setting advanced options
Controlling access to Security Explorer
Using the command line
Opening a command prompt window
SxpBackup.exe
SxpClone.exe
SxpExport.exe
SxpGrant.exe
SxpHomeDir.exe
SxpInheritance.exe
SxpOwner.exe
SxpRestore.exe
SxpRevoke.exe
SXPActiveDirectoryBackup
SxpSearch.exe
Using PowerShell cmdlets
What are cmdlets?
Using Security Explorer cmdlets
Troubleshooting
Creating or editing the PowerShell.exe.config file
Installing Security Explorer cmdlets
Installing Security Explorer cmdlets manually
Removing Security Explorer cmdlets
Using cmdlets to set up Access Explorer
Creating the Access Explorer database
Adding a service account
Adding a domain to manage
Adding managed computers
Using cmdlets to get information about Access Explorer objects
Getting service account information
Getting managed domain information
Getting managed computer information
Getting security information for a resource
Getting resource access information
Using cmdlets to manage Access Explorer agents
Identifying agents on a managed computer
Changing the agent configuration on a managed computer
Restarting the agent
Restarting a single agent
Updating an agent
Changing the service account password
Changing the SQL account password
Using cmdlets to remove Access Explorer objects
Searching
Have you ever wondered just which files and directories on your network the group Everyone can delete permissions on? Finding information like this is a snap with Security Explorer®. Simply choose a group or user, and a set of permissions to search for, and begin your search. When the search results display, you can click on any files or directories in your search results to modify their permissions immediately.
|
NOTE: For searching the SQL Security module, see Searching for SQL Server objects and permissions. For searching the Exchange Security module, see Searching for Exchange server objects and permissions. For searching in SharePoint Security module, see Searching for SharePoint objects. For searching the Active Directory Security module, see Searching for Active Directory objects. |
Using the Browse tab to search
|
2 |
Open the Browse tab. |
|
3 |
Select an object in the Navigation or Objects pane, and select Search | New Search Window (Empty). |
, press |
6 |
Click Start Search. |
The Permissions column in the Permissions pane may list abbreviations of some permissions.
To see what permissions are set, right-click the permission, and choose Modify Permission.
|
7 |
Select Auto-update results to automatically update the search results after you select to grant, revoke, clone, replace, modify, or delete a permission. The search is performed again during the refresh, so if you have a search that takes a long time, you may want to clear this check box. |
|
Add a Search Scope, which is what you want to search, such as domains, computers, or folders. See Adding a search scope. | |
|
NTFS Security module only. Load saved search scope and criteria from an XML file exported from the Share Security module. | |
|
Share Security module only. Load saved search scope and criteria from an XML file exported from the NTFS Security module. | |
|
Start the search based on the current Search Scope and selected criteria. | |
|
Return to the default selections on all search criteria tabs. | |
|
Display the results in a report format that you can save, print, or export. | |
|
Service Security and Task Management modules only. Export the results. See Using the Browse tab to export security. | |
|
Schedule a search using the current Search Scope and selected criteria. See Scheduling a search. |
Managing saved searches
You can save the search scope and selected criteria to reuse. You also can export the scope and settings to an XML file for later import into another module. Saved searches appear under Saved Searched | User Searches.
|
Import the search scope and search criteria from an exported XML file. | |
Adding a search scope
The Search Scope determines what objects to search, such as domains, computers, or folders.
|
1 |
Click Add Scope. |
Type a location (all modules) or LDAP path (Service Security and Active Directory Security modules only) in the box. If you enter a location or LDAP path, you must select a type: Domain, Computer, Folder (NTFS Security module only), AD Forest, AD OU, or AD Container (Service Security module only).
|
TIP: Use the Select all children for the current item or De-select all children for the current item check boxes to help you create the scope.
NOTE: In the Service Security module, you can import a list of servers. Click Import, and choose a text file.
NOTE: In the Group and User Management module, you can select individual computers, computers in a Network node, or Active Directory® organizational units and containers that contain computers. When the Active Directory tree is used in the search scope, Security Explorer® searches only local users and groups for the computers in the selected organizational unit or container, or local users and groups for selected computers. Security Explorer does not search domain users and groups in Active Directory. If you want to search for domain users and groups, select computers in the Network node.
|
|
3 |
Click OK. |