Security Explorer 9.9

Managing permissions

To help you manage security, Security Explorer® is organized into modules, which organize the permissions that are available to manage. First, click the module button that matches the permissions you want to manage. For ease of use, each module functions similarly, although menu choices and buttons may vary from module to module.


	NOTE: This chapter covers managing permissions. While the permissions vary from module to module, the process is basically the same, so several modules are covered in this chapter. Other functions in Security Explorer, including the Task Management and Group and User Management modules, are covered in the Managing security and Managing objects chapters.

•

•

•

•

•

Creating permission templates

•

Copying permissions

•

Copying permissions to subfolders and files

•

Setting ownership

•

Modifying permissions

•

Reducing permissions to read only

•

Managing group memberships

•

Renaming accounts

•

Deleting permissions

•

Printing permissions

Viewing permissions

To view permissions

Open the module that reflects the permissions you want to view.

Open the Browse tab.

–OR-

Open the Tasks tab, and click View Permissions.


	NOTE: The Tasks tab is hidden by default. To display the Tasks tab, select View \| Tasks tab.

Select an item in the Navigation pane. The location displays in the Path box. The Objects pane displays objects along with the extended information. Depending on how far you drill down in the navigation tree, you may need to select an object in the Objects pane to view permissions.

If necessary, select an object in the Objects pane. The Permissions pane displays permissions for the selected object. The Owner box displays the user or group that owns the selected object.


	TIP: If you know the path to the permissions you need, type the path, in either drive letter notation or UNC pathname format, in the Path box, and click Go. NOTE: SharePoint Security module only. To add a URL to the Favorites list, type the URL in the Path box, and click Go.

•

If the object you chose contains a large number of sub items, you may see a message box. You can choose to show or hide the progress display.

•

If loading is taking too long, you can click Stop in the loading progress bar. See Using the loading progress bar.

•

In the Permissions pane, icons next to each account name indicate the type of user or group. Domain users and disabled users can be highlighted if the option is set on the Tools | Options | View tab. See Setting view options.

Set options for the displayed permissions. See Using the Permissions pane.

Granting permissions

You can grant permissions to users and groups without affecting any other user's permissions. First, choose the permissions to grant, and select a user or group. You can grant different permissions for several users and groups with one operation. In the NTFS Security module, you can create a schedule to temporarily grant a permission.

The type of permission granted depends on the selected module. For example, if you want to grant permissions for a printer, open the Printer Security module.


	NOTE: For NetApp Clustered mode, to see changes after a permission action on folders and shares, you must refresh the tree in the Navigation pane. NOTE: To customize the grant process in the NTFS module, you can set options for modifying permissions. See Setting advanced options.

There are two methods for granting permissions:

•

Using the Browse tab to grant permissions

•

Using the Grant task

Using the Browse tab to grant permissions

To use the Browse tab to grant permissions

Open the module for the type of permission you want to grant.

Open the Browse tab.

Select an item in the Navigation pane.

–OR-

Type a path in the Path box, and click Go.

Select an object in the Objects pane or a permission in the Permissions pane.

Select Security | Grant Permissions.

-OR-

Click

, click Grant on the Control Buttons Bar; or right-click the object or permission, and choose Grant Permissions.

The Grant Folder Permissions dialog box displays the path, and the associated groups and users for the current object. The navigation tree is hidden by default. To view the navigation tree, click 4.

Select the groups and users to apply the permission. There are a few methods for selecting groups and users.

•

Choose from the list of local and domain groups and users in the navigation tree.

•

To filter the list in the left pane, type a server name or base path in the box, and click Set.

•

To return the full list to view, click Reset. The list returns to full view the next time you open Grant Permissions.

•

Select from the list of groups and users associated with the current object.

•

To change to another domain or to the local computer, select the domain or the local computer from the List Names From list.

•

To display users in the list, click Show Users. To return the list to show only groups, click Refresh.

•

To select a group/user not displayed, type a name or click Advanced User Selection.

•

Browse for a group or user.

From the Permission list, select the permissions to grant.

•

If you select Special, a Permission tab specific to the module opens. You also can open the tab by clicking Advanced Permission Selection. The Permission tab displays the permissions based on the selection in the Permission list. If you make any changes, the Permission type changes to Special with the selected permissions in parenthesis.

•

NTFS security module only. Selecting the List Folder Contents permission grants a Read and Execute permission, but excludes files. The scope for Read and Execute includes files; the scope for List Folder Contents excludes files.

Windows Server® 2012 or Windows® 8 only. In the Conditions box, you can type a condition expression or click Condition Selection to build an expression.

From the Applies To list, select how to apply the permissions.

From the Action list, select whether to replace or add to the group/user’s current permissions.

To add the group/user to the List of users and groups to grant list, click Add.


	TIP: To add additional groups or users to the List of users and groups to grant list with the selected permission settings, you can hold down CTRL or SHIFT, and click a group or user from the list or double-click a group or user in the navigation tree.

Choose options.

Table 1. Grant options
Option	Description
Overwrite ALL permissions with the groups and users listed below (use with caution)	Select to overwrite the permissions on the selected folders, subfolders, and/or files with the specified permissions.
Include protected objects (objects with ‘Inherit Permissions from Parent’ disabled)	Select to grant permissions on protected objects.