Security Explorer 9.1. User Guide

Security Explorer 9.1 User Guide

Security Explorer 9.1 User Guide Explorer 8 Installation Guide ii 2013 by Quest Software All rights reserved. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Quest Software, Inc. The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA 92656 www.quest.com. email: legal@quest.com Refer to our Web site for regional and international office information. Trademarks Quest, Quest Software, the Quest Software logo, Simplicity at Work and Security Explorer are trademarks of Quest Software, Inc. and its subsidiaries. For a complete list of Quest Software trademarks, see www.quest.com/legal/trademarks.aspx. All other trademarks are property of their respective owners. Security Explorer User Guide October 2013 Version 9.1.1

Security Explorer 9.1 User Guide Explorer 8 Installation Guide iii About Quest Software Corporation Quest Software simplifies and reduces the cost of managing IT for more than 100,000 customers worldwide. Our innovative solutions make solving the toughest IT management problems easier, enabling customers to save time and money across physical, virtual and cloud environments. For more information about Quest go to www.quest.com. Contacting Quest Software Phone Email Mail Web site 949.754.8000 (United States and Canada) info@quest.com Quest Software, Inc. World Headquarters 5 Polaris Way Aliso Viejo, CA 92656 USA www.quest.com Please refer to our Web site for regional and international office information. Contacting Quest Support Quest Support is available to customers who have a trial version of a Quest product or who have purchased a Quest product and have a valid maintenance contract. Quest Support provides unlimited 24x7 access to SupportLink, our self-service portal. Visit SupportLink at http://support.quest.com. From SupportLink, you can do the following: Review thousands of solutions from our online Knowledgebase Download the latest releases and service packs Create, update and review Support cases View the Global Support Guide for a detailed explanation of support programs, online services, contact information, and policy and procedures. The guide is available at: http://support.quest.com.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide iv Table of Contents Getting Started with Security Explorer... 1 Starting Security Explorer... 1 Examining the Tasks Tab... 1 Selecting Modules... 1 Menus... 2 File Menu... 2 View Menu... 2 Security Menu... 3 Search Menu... 3 Tools Menu... 4 Help Menu... 5 Tool Bar... 5 Choosing an Interface... 7 Examining the Browse Tab... 7 Using the Objects Pane... 8 Setting the Path... 8 Using the Permissions Pane... 8 Sorting Permissions... 8 Customizing the View... 9 Showing/Hiding Module Buttons... 9 Showing/Hiding Modules... 9 Adjusting the View... 9 Showing/Hiding the Tool Bar... 9 Showing/Hiding the Status Bar... 10 Showing/Hiding the Control Pane and Buttons Bar... 10 Showing/Hiding the Loading Progress Bar... 10 Completing a Process... 10 Managing Permissions... 11 Viewing Permissions... 11 Granting Permissions... 12 Using the Grant Task... 12 Using the Browse Tab to Grant Permissions... 13 Revoking Permissions... 14 Using the Revoke Tasks... 14

Security Explorer 9.1 User Guide Explorer 8 Installation Guide v Using the Browse Tab to Revoke Permissions... 15 Cloning Permissions... 17 Using the Clone Task... 17 Using the Browse Tab to Clone Permissions... 17 Selecting Users/Group Manually... 18 Selecting Users/Groups Automatically... 18 Updating Permissions Relating to a User s SID History... 19 Viewing SID History Detail... 19 Importing Groups and Users... 20 Completing the Clone Process... 20 Creating Permission Templates... 21 Copying Permissions... 21 Copying Permissions to Subfolders and Files... 22 Setting Ownership... 22 Using the Set Ownership Task... 22 Using the Browse Tab to Set Ownership... 23 Modifying Permissions... 23 Reducing Permissions to Read Only... 24 Managing Group Memberships... 24 Renaming Accounts... 25 Deleting Permissions... 25 Printing Permissions... 26 Running a Report Using the Reports or Tasks Tab... 26 Running a Report Using the Browse Tab... 26 Searching... 27 Using the Search Tasks... 27 Using the Browse Tab to Search... 27 Adding a Search Scope... 28 Setting Search Criteria... 28 Group/User Search Criteria... 28 Permission Search Criteria... 29 Folder and File Search Criteria... 31 Service and Task Search Criteria... 31 Group/User Search Criteria... 31 Advanced Search Options... 32 Starting the Search... 32 Replacing Permissions... 33

Security Explorer 9.1 User Guide Explorer 8 Installation Guide vi Saving Search Criteria... 33 Saving Search Results... 34 Managing Security... 35 Backing up Security... 35 Backup File Types... 35 Using the Backup Task... 35 Using the Browse Tab to Back up Security... 36 Scheduling a Backup... 37 Using the Backup Scheduler... 38 Restoring Security... 38 Exporting Security... 41 Using the Export Task... 41 Using the Browse Tab to Export Security... 42 Deleting Export Tasks... 43 Managing Objects... 44 Managing Folders and Files... 44 Creating a New Folder... 44 Deleting a Folder or File... 44 Viewing Folder and File Properties... 44 Showing Open Files... 45 Opening Files... 45 Editing Files... 45 Opening Windows Explorer... 45 Managing Shares... 46 Creating a New Share... 46 Removing a Share... 46 Finding a Share Path... 46 Managing Registry Keys... 47 Creating a New Registry Key... 47 Deleting a Registry Key... 47 Managing Services... 47 Setting Logon Accounts... 48 Removing a Service... 48 Modifying Service Properties... 48 Using the Properties Task... 48 Using the Browse Tab to Modify Service Properties... 49 Managing Tasks... 49

Security Explorer 9.1 User Guide Explorer 8 Installation Guide vii Running a Task... 49 Setting Account Information... 50 Creating a New Task... 50 Copying a Task... 50 Removing a Task... 50 Modifying Task Properties... 51 Managing Groups and Users... 51 Viewing Accounts... 52 Creating a New Group... 52 Creating a New User... 53 Modifying Group and User Properties... 54 Modifying Group or User Active Directory Properties... 54 Modifying Properties of Multiple Users... 54 Modifying Group Memberships... 55 Adding a User or Group... 55 Viewing Group and User Memberships... 56 Changing User Passwords... 56 Modify Memberships of Multiple Local Groups... 57 Clearing the Local Administrator Group... 57 Deleting Groups and Users... 58 Managing Favorites... 58 Adding Favorites... 58 Exporting Favorites... 59 Importing Favorites... 59 Removing Favorites... 59 Managing Enterprise Scopes... 60 Creating an Enterprise Scope While Browsing... 60 Creating an Enterprise Scope... 61 Editing an Enterprise Scope... 61 Removing an Enterprise Scope... 62 Viewing Licenses... 62 Managing Network Drives... 62 Mapping a Network Drive... 62 Disconnecting a Network Drive... 62 Working with Microsoft SQL... 63 Viewing SQL Server Permissions... 63 Granting SQL Server Permissions... 63 Revoking SQL Server Permissions... 64 Cloning SQL Server Permissions... 65

Security Explorer 9.1 User Guide Explorer 8 Installation Guide viii Modifying SQL Server Permissions... 65 Searching for SQL Server Objects and Permissions... 66 Setting SQL Server Search Criteria... 66 Backing Up and Restoring SQL Server Security... 67 Exporting SQL Database Permissions... 67 Managing SQL Server Objects... 68 Copying SQL Server Objects... 68 Copying SQL Permissions... 68 Managing Databases... 68 Adding a New Database Role... 68 Removing a Database Role... 69 Modifying a Database Role... 69 Adding a New SQL Database User... 69 Removing an SQL Database User... 69 Modifying an SQL Database User... 69 Adding a New Schema... 70 Removing a Schema... 70 Modifying a Schema... 70 Managing Logins... 70 Adding a New Login... 70 Removing a Login... 70 Modifying a Login... 71 Managing Server Roles... 71 Adding a Server Role... 71 Removing a Server Role... 71 Modifying Server Roles... 71 Managing Security SQL Reporting Services... 72 Managing System Roles... 72 Creating a New System Role... 72 Deleting System Roles... 72 Modifying a System Role... 72 Managing Catalog Roles... 73 Creating a New Catalog Role... 73 Deleting Catalog Roles... 73 Modifying a Catalog Role... 73 Managing Catalog Items... 73 Granting SSRS Permissions... 73 Revoking SSRS Permissions... 74 Cloning SSRS Permissions... 74 Searching for SSRS Permissions... 75 Setting Search Criteria... 75 Modifying SSRS Permissions... 76 Copying SSRS Permissions... 76 Deleting SSRS Permissions... 76

Security Explorer 9.1 User Guide Explorer 8 Installation Guide ix Exporting SSRS Permissions... 76 Backing Up and Restoring SSRS Permissions... 76 Setting SQL Options... 77 Modifying SQL Server Security Settings... 78 Managing SQL Network Settings... 78 Working with Microsoft Exchange... 79 Checking Minimum Requirements... 79 Viewing Exchange Permissions... 79 Granting Exchange Permissions... 80 Revoking Exchange Permissions... 80 Cloning Exchange Permissions... 81 Searching for Exchange Server Objects and Permissions... 82 Setting Exchange Security Search Criteria... 82 Backing Up and Restoring Exchange Server Security... 83 Modifying Exchange Permissions... 84 Managing Exchange Group Memberships... 84 Exporting Exchange Security Permissions... 85 Creating Exchange Databases... 85 Creating Public Folder Mailboxes... 86 Managing Exchange Administrators... 86 Adding Exchange Administrators... 86 Modifying Exchange Administrators... 86 Deleting Exchange Administrators... 87 Managing Exchange Distribution Groups... 87 Adding Distribution Groups... 87 Modifying Distribution Groups... 87 Deleting Distribution Groups... 87 Managing Mail Contacts... 88 Creating Mail Contacts... 88 Modifying Mail Contacts... 88 Deleting Mail Contacts... 88 Managing Mail Users... 88 Creating Mail Users... 88 Modifying Mail Users... 89 Deleting Mail Users... 89 Managing Mailboxes... 89 Creating Mailboxes... 89

Security Explorer 9.1 User Guide Explorer 8 Installation Guide x Deleting Mailboxes... 90 Creating Mailbox Folders... 90 Deleting Mailbox Folders... 90 Managing Permissions on Mailbox Folders for Multiple Users... 90 Modifying Mailbox Settings... 90 Managing Public Folders... 91 Creating Public Folders... 91 Deleting Public Folders... 91 Modifying Public Folder Settings... 92 Using Role Based Access Control... 92 Managing User Roles... 93 Adding a User Role... 93 Modifying User Roles... 93 Deleting User Roles... 93 Managing Role Groups... 93 Adding Role Groups... 93 Modifying Role Groups... 94 Deleting Role Groups... 94 Managing Roles... 94 Managing Custom Scopes... 95 Creating a Management Scope... 95 Editing a Management Scope... 95 Deleting Management Scopes... 95 Setting Options for Exchange Security... 96 Working with Microsoft SharePoint... 98 SharePoint Menu... 98 Adding SharePoint Farms or Sites... 98 Managing SharePoint Farms or Sites... 99 Deploying the SharePoint Web Service... 99 Deploying the SharePoint Web Service Manually... 101 Viewing SharePoint Permissions... 102 Previewing SharePoint Objects... 103 Granting SharePoint Permissions... 103 Revoking SharePoint Permissions... 103 Cloning SharePoint Permissions... 104 Selecting Groups or Users Manually... 105 Importing Groups and Users from a File... 105 Managing SharePoint Groups... 106 Repairing Limited Access Permissions... 106

Security Explorer 9.1 User Guide Explorer 8 Installation Guide xi Removing Permissions for Deleted Accounts... 107 Removing Permissions for Disabled Accounts... 107 Removing Accounts from SharePoint Groups... 108 Searching for SharePoint Objects... 108 Setting SharePoint Security Search Criteria... 109 Modifying SharePoint Permissions... 110 Modifying SharePoint Permissions Levels... 111 Modifying SharePoint Properties... 111 Backing Up and Restoring SharePoint Security... 111 Exporting SharePoint Permissions... 111 Deleting Export Tasks... 112 Setting SharePoint Options... 112 Removing the SharePoint Web Service... 113 Removing the SharePoint Web Service Manually... 114 Working with Quest Access Manager... 116 Adding Access Manager Servers... 116 Viewing Access Manager Objects... 116 Viewing Groups and Users... 116 Viewing Computers... 116 Viewing Resource Groups... 116 Viewing Permissions... 117 Searching Access Manager Servers... 117 Running the Access Manager Permission Wizard... 117 Changing All Permissions... 118 Cloning All Permissions... 119 Deleting All Permissions... 119 Exporting All Permissions... 120 Backing Up Permissions... 120 Setting Options for Access Manager... 120 Customizing Security Explorer... 122 Setting General Options... 122 Setting View Options... 123 Setting Alternate Credentials for Services and Tasks... 124 Setting Advanced Options... 124 Controlling Access to Security Explorer... 126

Security Explorer 9.1 User Guide Explorer 8 Installation Guide xii Using the Command Line... 127 Using PowerShell Cmdlets... 127 Creating or Editing the PowerShell.exe.config File... 127 Installing PowerShell Cmdlets... 128 Installing PowerShell Cmdlets Manually... 128 Removing PowerShell Plugins... 128 Opening a Command Prompt Window... 129 SxpBackup.exe... 129 SxpClone.exe... 130 SxpExport.exe... 131 SxpGrant.exe... 132 SxpHomeDir.Exe... 134 SxpInheritance.exe... 134 SxpOwner.exe... 136 SxpRestore.exe... 137 SxpRevoke.exe... 138 Troubleshooting... 139 Repairing Inheritance... 139 Creating Test Folders and Files... 139 Using Log Files... 140 SharePoint Web Service Removal Fails... 141 Uninstalling Security Explorer... 141 Index... 142

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 1 Getting Started with Security Explorer Security Explorer has a robust interface that adapts to the explorer module you select so you are able to focus on the task at hand. In this chapter you will find information about the overall user interface, such as menus, icons, and adjusting the display. Starting Security Explorer Click Start, point to All Programs Quest Software Security Explorer 9, and then choose Security Explorer 9. Examining the Tasks Tab The Navigation pane has five tabs. Tab Tasks Browse Reports Search Status Description Display the Home Page for the selected module. You can browse the tree and select tasks from the Home Page, Tool Bar, or Menu Bar. Display the Browse tab where you can view the Navigation tree. When displaying All Management Targets, the Reports tab lists reports available for all modules. You also can select a specific module and select reports from shortcut menus. Create search criteria to locate specific permissions. Becomes available when a module is selected. See Using the Browse Tab to Search. Display status of current processes. The information is also available on the status bar, which is hidden by default. See Showing/Hiding the Status Bar. Selecting Modules Security Explorer is organized around modules: NTFS Security, Share Security, Registry Security, Printer Security, Service Security, Task Management, Group and User Management, SharePoint Security, SQL Server Security, and Exchange Security. For example, click the Share Security button to manage share permissions or click the Printer Security button to manage printer permissions. By default, All Management Targets is selected. To change to a different module, click the corresponding button. Module Icon Module Button Module Icon Module Button All Management Targets NTFS Security Share Security Registry Security Printer Security Task Management Group and User Management SharePoint Security SQL Server Security Exchange Security Service Security

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 2 Menus Note: Menu options vary depending on the selected module. File Menu Menu Option Print Exit Description Print the selected object s permissions. Close Security Explorer. View Menu Menu Option Reload Current Path Reload Current Path (No Progress) Refresh Permissions Only Reset All Standard Mode Interface Classic Mode Interface Basic Mode Interface Tasks Tab Tool Bar Small Tool Bar Status Bar Control Buttons Bar Control Pane Loading Progress Bar Progress when Loading Stop Button when Loading Active Directory Tree Node Enterprise Scope Tree Node Filters Folder Sizes Refresh Folder Sizes Reset View to Defaults Description Reload the path displayed in the Path box and show its progress. Reload the path displayed in the Path box without showing progress. Reload permissions for the selected object. Remove all selected objects and permissions from the display. Set view to Standard Mode. Set view to Classic Mode. Set view to Basic Mode. Hide or show the Tasks tab. Hide or show the Tool Bar. Hide or show the small Tool Bar. Hide or show the Status Bar. Hide or show the Control Buttons bar. Hide or show the Control Pane. Hide or show the Loading Progress Bar. Hide or show the progress when loading permissions. Hide or show a Stop button when loading permissions. Add Active Directory to the tree in the Navigation pane. Add Enterprise Scope to the tree in the Navigation pane. All Management Targets only. Hide or show the Filters pane. NTFS module only. Display folder sizes in Permissions pane. NTFS module only. Reload folder sizes. Return the main window to the default settings.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 3 Security Menu Menu Option Grant Permissions Revoke Permissions Clone Group or User Set Ownership Logon Accounts Copy to Subfolders and Files Repair Inheritance Reduce to Read Only Permission Levels SharePoint Groups Repair Limed Access Permissions Remove Permissions for Deleted Accounts Delete Permission Modify Permission Copy Permission Paste Permission Select All Permissions Backup Security Restore Security Backup Scheduler Export Export Scheduler Permission Templates Description Grant permissions to the selected object. Revoke permissions from the selected object. Clone the permissions of the selected object. NTFS module only. Set the owner of the selected object[s]. Service Security module only. Set the logon account for the selected service. Copy permissions from a parent folder to its subfolders and files. Permissions on the parent folder do not change. NTFS module only. Restore inheritance to the selected folder. NTFS module only. Reduce permissions on the selected object to Read Only. SharePoint module only. Edit permission levels for a selected SharePoint object. SharePoint module only. Manage groups for SharePoint objects. SharePoint module only. Remove orphaned Limited Access permissions that remain after an account is deleted. SharePoint module only. Remove all permissions associated with deleted Active Directory accounts on a SharePoint site. Delete permissions of the selected object[s]. Change the permissions of the selected object. Copy the selected permission[s] to clipboard. Paste permissions from clipboard. Select all permissions in the active pane. Back up permissions to a file. Restore permissions from a file. Add, edit, or delete backup tasks. Export permissions to a file. NTFS and SharePoint modules only. Add, edit, or delete export tasks. NTFS module only. Create permission templates. Note: The Task Management and Group and User Management modules do not have a Security menu, so the items that you would normally find on the Security menu are found on a shortcut menu. Search Menu Menu Option Add Search Scope Start Search New Search Window (Empty) Save Search Description Add search criteria. Start the search. Start a search in a separate window. Save the search criteria.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 4 Tools Menu Menu Option New Folder Delete Folder or File New Registry Key Delete Registry Key New Delete Remove Show Open Files Open File Edit File Set Account Information Start Stop Pause Restart Open with Windows Explorer Command Prompt Here Display Group Contents Display Memberships SQL Server Security Settings SQL Network Settings Change Password Properties Active Directory Properties Find Share Path Create Share Remove Share Map Network Drive Disconnect Network Drive Manage Computer Favorites Manage Exchange Favorites Manage Favorites Add to Favorites Manage Enterprise Scope Add to Enterprise Scope Access Manager Permission Wizard Access Manager Configuration Options Description NTFS module only. Create a new folder. NTFS module only. Delete the selected folder or file. Registry module only. Create a new Registry key. Registry module only. Delete the selected Registry key. Create a new group, user, SQL Server object, or Exchange Server object. Delete the selected group, user, SQL Server object or Exchange Server object. Delete the selected service or task. NTFS module only. View list of files that are open. NTFS module only. Open a file in its associated application. NTFS module only. Open a file in its associated application for editing. Task module only. Set the account to run the selected task. Service module only. Start a selected service. Service module only. Stop a selected service. Service module only. Pause a selected service. Service module only. Restart a selected service. Open Windows Explorer to the selected folder, file, or share. NTFS module only. Open a DOS window. Display the members of a selected group. Display the groups of which the selected user is a member. SQL Server module only. View and modify SQL Server Security Settings. SQL Server module only. View and modify SQL Network Settings. Group and User module only. Set the password of the selected user or generate a random password. Open the Properties window for the selected object. Group and User module only. Open the Active Directory Properties window for the selected group or user. Share module only. Go to the selected share in the NTFS module. Share module only. Create a new share. Share module only. Remove selected shares. NTFS and Share modules only. Map a selected network drive. NTFS and Share modules only. Disconnect a selected network drive. Opens the Manage Computer Favorites window. Exchange module only. Opens the Manage Exchange Favorites window. Open the Manage Favorites window. Add the selected object[s] to list of favorites. Open the Manage Enterprise Scope window. Add selected object[s] to Enterprise Scope. Make enterprise-wide changes to Access Manager objects Set up the Access Manager feature by configuring the Managed Server and adding Managed Hosts. Customize Security Explorer.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 5 Help Menu Menu Option Security Explorer on the Web Technical Support Customer Feedback Help Improve Security Explorer Create Test Folders and Files Help Check for Updates About Security Explorer Description Go to the Quest Web site. Go to the Quest Technical Support page. Go to the Quest Product Feedback Page. Participate in a program to improve the next version of Security Explorer. NTFS module only. Create a directory structure of files and folders for evaluation. Access online help. By default, Security Explorer checks for updates during start up. You can disable the automatic check or you can initiate a check for updates manually. View information about the version of Security Explorer installed on your computer or view the End User License Agreement. Tool Bar The most common operations performed in Security Explorer can be accessed through the Tool Bar. Some Tool Bar buttons are unavailable depending on which module is selected. Operations on the Tool Bar are available also on the menus, the Control Pane, and the Control Buttons. Note: You can show or hide the Tool Bar, Control Pane, and Control Buttons through the View menu. By default, the icons on the Tool Bar are large and few display. To view a full Tool Bar, choose View Small Tool Bar. See View Menu. Tool Bar Description Grant permissions. Revoke permissions. Clone a group or user. Set Ownership. NTFS module only. Set passwords for logon accounts. Service module only. Add new group or user. Group and User module only. Copy to subfolders and files. NTFS module only. Repair inheritance. Reduce permission to read-only. Repair limited access permissions on selected SharePoint sites. Repair limited access permissions on selected SharePoint sites. Start a search in a separate window. Start selected service. Service module only. Run selected task. Task module only. Stop selected service. Service module only.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 6 Tool Bar Description Pause selected service. Service module only. Restart selected service. Service module only. Modify the selected permissions. Delete the selected permissions. Copy the selected permissions. Pastes copied permissions. Back up permissions to a file. Restore permissions from a backup file. Schedule a backup. Export file and directory permissions to a file. Schedule Export tasks. Open the selected folder in Windows Explorer. Open a command prompt window. Open the Properties window. Create a new share. Remove selected shares Map a network drive. Disconnect a network drive. SQL View and modify SQL Server Security Settings. SQL module only. View and modify SQL Network Settings. SQL module only. Open the Manage Favorites window. Add the selected object to Favorites. Open the Manage Enterprise Scope window. Add new Enterprise Scope. Reload the path displayed in the Path box and show its progress. Reset all. Display SharePoint site in a web browser. SharePoint module only. Open online help.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 7 Choosing an Interface There are three interface modes that you can select from on the View menu: Standard Mode, Classic Mode, and Basic Mode. You also can choose the individual elements to create your own unique interface. No matter which view or options you choose, the same view is restored each time you start Security Explorer. To reset the options to the default, choose View Reset View to Defaults. Interface Type Standard Mode Interface Classic Mode Interface Basic Mode Interface Reset View to Defaults View Menu Selections Task Tabs, Tool Bar, Small Tool Bar, Status Bar, Control Buttons Bar, and Control Pane Tool Bar, Small Tool Bar, Status Bar, and Control Buttons Bar None Tasks Tab, Tool Bar, and Control Pane Examining the Browse Tab The Browse tab provides greater detail when managing permissions. Some options on the Tasks tab automatically open the Browse tab. The Browse tab is organized into three panes where you can select and view information. The Navigation pane contains the tree for the selected module. You can browse the tree and select an object to display in the Objects pane. You can select objects from the local computer, or browse the Network Neighborhood or Active Directory. You can also group objects into Favorites or Enterprise Scopes. See Managing Favorites and Managing Enterprise Scopes. The Objects pane displays the folders, files, and objects for the selected item in the Navigation pane. You also can type a path in the Path box to view the contents of a folder, or the services and tasks on a computer. The Permissions pane displays the permissions for the selected object. The Task Management module does not have a Permissions pane. Other components of the main window are optional and can be hidden from view. The Menu Bar, Tool Bar, and Control Pane provide options and icons to perform functions in Security Explorer. The Loading Progress Bar displays the progress of loading permissions and allows you to stop the load if necessary.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 8 Using the Objects Pane The Objects pane displays the contents of the item selected in the Navigation pane. The path to the object displays in the Path box. If the path is longer than the length of the box, click to scroll the path or hover the cursor to view the path. Note: If you see in the tree in the Navigation pane, the item was loaded from the cache, which is also indicated by CACHE in the status bar. You can disable the cache indicator by clearing the View indicator when items loaded from cache check box on the Tools Options Advanced tab. See Setting Advanced Options. Button Description Go up one level in the tree displayed in the Navigation pane. Go Set Reset Show All Go to the path displayed in the Path box. Use when you type a path in the box. SharePoint Security module only. Add the URL displayed in the Path box to the Favorites list. Set the root node in the Navigation pane based on the path or URL displayed in the Path box. Reset the path to the default selection. NTFS Security module only. You can filter the list to show only folders or file, show both folders and files, or show no folders or files. Setting the Path To help you quickly find an item in the Navigation pane, you can set a path to set a new root node. Type a path or URL in the Path box, or select a path in the Navigation pane, and then click Set. The root node in the Navigation pane is set to the new path or URL. The new root node is in effect until you click Reset or restart Security Explorer. The setting does not transfer to other modules. Using the Permissions Pane The Permissions pane displays the permissions for the object selected in the Objects pane. You can modify permissions of the parent object. If the permissions are inherited and cannot be changed, the list is gray. The Object box displays the object selected in the Objects pane. The Owner box displays the owner account name and SID. Allow inheritable permissions from parent to propagate to this object. Select to propagate permissions to the selected object from the parent. If you select this check box, a warning box displays the selected object and its parent along with the parent s permissions so you can decide whether or not to continue. Inherited permissions display in gray and cannot be changed. Show Permissions By default, permissions display when an object is selected. To save time while you browse the network, you can clear this check box. Sorting Permissions To sort a column, click on the column heading. The arrow in the heading indicates the direction of the sort. Click again to change the sort direction.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 9 Customizing the View Showing/Hiding Module Buttons You can hide module buttons to increase the area for navigating the trees in the various tabs. To hide buttons, drag the split bar down. You also can click, and then select Show Fewer Buttons. To show buttons, drag the split bar up. You also can click, and then select Show More Buttons. To access a button that does not show on the icon bar, click, and then select the module. Note: By default, unlicensed modules display in the Navigation pane. To hide unlicensed module buttons, uncheck View Unlicensed Modules. Showing/Hiding Modules You can hide unused modules that display in the tree to increase the area available for navigation on the Tasks and Browse tabs. The modules buttons remain even if you filter the module. 1. Click All Management Targets. 2. Open either the Tasks or Browse tab. 3. Choose View Filters. 4. Point to Filters to view the filter selections. You can choose All, None, or select specific modules to display. To keep the filter list on the screen, click. To hide the filter list, click. Adjusting the View To rearrange the view, size panes by dragging the vertical and horizontal split bars. Note: The position of the horizontal split bar between the Objects and Permissions panes is saved on each individual module window. To return the display to the original configuration, choose View Reset to Defaults. Showing/Hiding the Tool Bar To show the large icon Tool Bar, choose View Tool Bar. To show the small icon Tool Bar, choose View Tool Bar and Small Tool Bar.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 10 Showing/Hiding the Status Bar The Status Bar displays along the bottom of the Security Explorer window. The right-side of the Status Bar displays the number of selected objects and permissions. CACHED indicates that the information displayed was loaded from the cache. To reload the information, click or Reload, press F5 or Alt+F5, or choose View Reload Current Path or View Reload Current Path (No Progress). On the Browse tab, you also can choose Reload Current Path from the shortcut menu. To show or hide the Status bar, choose View Status Bar. To disable or enable the CACHE feature, choose Tools Options Advanced tab. See Setting Advanced Options. Showing/Hiding the Control Pane and Buttons Bar You can show or hide the Control Pane and the Control Buttons Bar from the View menu. Showing/Hiding the Loading Progress Bar The Loading Progress Bar displays the progress when loading large folders or containers, such as registry keys or computers. You can click Stop to stop the load, except when Security Explorer is locating computers. Once the load is complete, click Reload to reload objects and permissions. Note: You can show or hide the Loading Progress Bar from the View menu. If you experience slower than expected browsing, you also can show or hide the Stop button and the progress display. Completing a Process With most Security Explorer processes, a progress dialog displays. Display progress (un-checking this option will speed-up processing) Select to display the progress in real time. Clear the check box to stop the display. Close this dialog when processing completes. Select to close the box when the processing is complete. To always close this box, see Setting General Options. When the process is complete, the number of objects processed and elapsed time displays. The Errors area displays any errors that occur during the process. Note: If any errors occur during processing, you can click Save Error Log to save the displayed errors (path and description) to a text (.txt) file.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 11 Managing Permissions To help you manage security, Security Explorer is organized into modules, which organize the permissions that are available to manage. First, click the module button that matches the permissions you want to manage. For ease of use, each module functions similarly, although menu choices and buttons may vary from module to module. Note: This chapter covers managing permissions. While the permissions vary from module to module, the process is basically the same, so several modules are covered in this chapter. Other functions in Security Explorer, including the Task Management and Group and User Management modules, are covered in the Managing Security and Managing Objects chapters. Viewing Permissions Note: The View Permissions task opens the Browse tab. 1. Open the module that reflects the permissions you want to view, and then open the Browse tab. 2. Select an item in the Navigation pane. The location displays in the Path box. The top right Objects pane displays objects along with the extended information. The bottom right Permissions pane displays permissions for the selected object. The Owner box displays the user or group that owns the selected object. Alternatively, type a path, in either drive letter notation or UNC pathname format, in the Path box, and then click Go. Note: SharePoint Security module only. To add a URL to the Favorites list, type the URL in the Path box, and then click Go. Note: You may see a message box if the item you chose contains a large number of sub items. You can choose to show or hide the progress display. Note: If loading is taking too long, you can click Stop. You can show or hide Stop and the loading progress on the View menu. See View Menu. In the Permissions pane, icons next to each account name indicate the type of user or group. Icon Group/User Users (all types) Local groups (including domain local groups) Domain users (indicator visible only if enabled on the Security Explorer Options View tab) See Setting View Options. Domain groups (indicator visible only if enabled on the Security Explorer Options View tab) See Setting View Options. Well known groups Disabled Users (indicator visible only if enabled on the Security Explorer Options View tab) See Setting View Options. Disabled Domain Users (indicator visible only if enabled on the Security Explorer Options View tab) See Setting View Options.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 12 Allow inheritable permissions from parent to propagate to this object Select to propagate permissions to the selected object from the parent. If you select the Allow inheritable permissions from parent to propagate to this object check box, a warning box displays the selected object and its parent along with the parent s permissions so you can decide whether or not to continue. Include protected objects (objects with Inherit Permissions from Parent disabled) Select to inherit permissions to protected objects. The displayed permissions are inherited to protected objects once you click Yes. If you clear the Allow inheritable permissions from parent to propagate to this object check box, a warning box displays the choices you have for preventing propagation of permissions from the parent. To copy the inherited permissions to the object, click Copy. To remove the inherited permissions, click Remove. Show permissions Select to display permissions (default) for a selected object. Clear the check box to prevent the display of permissions in all windows and dialog boxes. This setting reverts to the default each time you open Security Explorer. Show Cluster File Shares Share Security module only. Select to view cluster file shares when browsing a computer that is a member of a cluster. Cluster file shares display in bold. If selected when the computer is not a member of a cluster, a message displays. Note: If the Auto-detect computers which are members of a cluster check box is selected on Tools Options Advanced tab, the check box is selected automatically for computers that are members of a cluster. For computers not members of a cluster, the Show Cluster File Shares check box is disabled even if the Auto-detect computers which are members of a cluster check box is selected. See Setting Advanced Options. Granting Permissions You can grant permissions to users and groups without affecting any other user's permissions. First, choose the permissions to grant, and then select a user or group. You can grant different permissions for several users and groups with one operation. The type of permission granted depends on the selected module. For example, if you want to grant permissions for a printer, open the Printer Security module. Using the Grant Task The Grant task provides a quick way to grant permissions. For more options, add at least one path, and then click Switch to Security Explorer Classic (Advanced). See Using the Browse Tab to Grant Permissions. 1. Open the Tasks tab, open the module for the type of permission you want to grant, and then click Grant. Include protected objects (objects with Inherit Permissions from Parent disabled Select to include objects that do not inherit permissions from the parent object. When you view the permission of the object, the Allow inheritable permissions from parent to propagate to this object check box is not selected. See Viewing Permissions. 2. Click Add to select paths.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 13 3. Click Add to select permissions. 4. Click OK. The Granting Permissions box displays the progress. See Completing a Process. Using the Browse Tab to Grant Permissions 1. Open the module for the type of permission you want to grant, and then open the Browse tab. 2. Select an item in the Navigation pane. Alternatively, type a path in the Path box, and then click. 3. Select an object in the Objects pane or a permission in the Permissions pane, and then click or Grant. Alternatively, choose Grant Permissions from the Security menu or the Control Pane, or right-click the object or permission, and then choose Grant Permissions from the shortcut menu. The Grant Folder Permissions dialog box displays the path, and the associated groups and users for the current object. 4. Select the groups and users to apply the permission. There are a variety of ways to select groups and users. To select a group or user, you can choose from the Groups and Users list in the left pane, or from the list in the right pane. The selected group or user displays in the Group/User box and the currently applied permission displays in the Permission box. Time Saver: If you want to apply the same permission to several groups and users, select the permission settings first, and then double-click the groups and users in the left pane. The groups and users are added to the List of users and groups to grant list with the selected permission settings. Note: During loading the Reload button becomes a Stop button. If loading is taking too long, you can click Stop. You can show or hide the Stop button on the View menu. To filter the list in the left pane, type a server name or base path in the box, and then click Set. To return the full list to view, click Reset. The list returns to full view the next time you open Grant Permissions. To change to another domain or to the local computer, select the domain or the local computer from the List Names From list. To display users in the list, click Show Users. To return the list to show only groups, click Refresh. To select a group/user who is not displayed, type a name or click Advanced User Selection. 5. From the Permission list, select the permissions to grant. Note: If you select Special, a Permission tab specific to the module opens. You also can open the tab by clicking Advanced Permission Selection. The Permission tab displays the permissions based on the selection in the Permission list. If you make any changes, the Permission type changes to Special with the selected permissions in parenthesis. Note: NTFS module only. Selecting the List Folder Contents permission grants a Read and Execute permission, but excludes files. The scope for Read and Execute includes files; the scope for List Folder Contents excludes files. 6. Windows Server 2012 or Windows 8 only. In the Conditions box, you can type a condition expression or click Condition Selection to build an expression. 7. From the Applies To list, select how to apply the permissions.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 14 8. From the Action list, select whether to replace or add to the group/user s current permissions. 9. To add the group/user to the List of users and groups to grant list, click Add. The selection is added to the list. Note: To add a selected group or user automatically to the List of users and groups to grant list with the selected permission settings, you can hold down CTRL or SHIFT, and then click a group or user in the top pane; or double-click a group or user in the left pane. Overwrite ALL permissions with the groups and users listed below (use with caution) Select to overwrite the permissions on the selected folders, subfolders, and/or files with the specified permissions. Include protected objects (objects with Inherit Permissions from Parent disabled) Select to grant permissions on protected objects. Note: Only users and groups in the List of users and groups to grant list are affected by the grant action. You can sort each column by clicking the column heading. To remove a selected user or group from the list, click Remove. 10. Click OK. The Granting Permissions box displays the progress. See Completing a Process. Revoking Permissions You can revoke access for users and groups. The type of permission revoked depends on the selected module. For example, if you want to revoke permissions for a printer, open the Printer Security module. Using the Revoke Tasks The Revoke basic task provides a quick way to revoke permissions. For more options, add at least one path, and then click Switch to Security Explorer Classic (Advanced). See Using the Browse Tab to Revoke Permissions. You also can use the Revoke All, Revoke Unknown, Revoke Disabled, and Revoke SID History advanced tasks to easily revoke permissions for those specific situations. 1. Open the Tasks tab, open the module for the type of permission you want to revoke, and then click Revoke. Include protected objects (objects with Inherit Permissions from Parent disabled Select to include objects that do not inherit permissions from the parent object. When you view the permission of the object, the Allow inheritable permissions from parent to propagate to this object check box is not selected. See Viewing Permissions. 2. Click Add to select paths. 3. Click Add to select permissions. 4. Click OK. See Completing a Process.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 15 Using the Browse Tab to Revoke Permissions 1. Open the module for the type of permission you want to revoke, and then open the Browse tab, if necessary. 2. Select an item in the Navigation pane, or type a path in the Path box, and then click Go. 3. Select an object in the Objects pane or a permission in the Permissions pane, and then click or Revoke. Alternatively, choose Revoke Permissions from the Security menu or Control Pane, or right-click the object, and then choose Revoke Permissions from the shortcut menu. 4. Select the groups and users to revoke the permission. There are a variety of ways to select groups and users. To select a group or user, you can choose from the Groups and Users list in the left pane, or from the list in the right pane. The selected group or user displays in the Group/User box. Time Saver: If you want to revoke the same permission from several groups and users, select the permission settings first, and then double-click the groups and users in the left pane. The groups and users are added to the List of users and groups to revoke list with the selected permission settings. Note: During loading the Reload button becomes a Stop button. If loading is taking too long, you can click Stop. You can show or hide the Stop button on the View menu. To filter the list in the left pane, you can type a server name or base path in the box, and then click Set. To return the full list to view, click Reset. The list returns to full view the next time you open Revoke Permissions. To change to another domain or to the local computer, select the domain or the local computer from the List Names From list. To change to another domain, select the domain from the List Names From list. To display users in the list, click Show Users. To return the list to show only groups, click Refresh. To add multiple users or groups, click. You can type names or paste names from a text file. You also can click Advanced User Selection to pick groups and users from a list. To select a group/user that is not displayed, type a name or click Advanced User Selection. 5. From the Permission list, select the permissions to revoke, and whether or not to Allow or Deny. If the choice is not available in the list, click Advanced Permission Selection to create a custom choice. Revoke all permissions (Allow and Deny) for the selected user Not available in the Task Management and Groups and Users Select to revoke all permissions (Allow and Deny) for the selected user. Include SID history search when adding permissions for revoking Select to invoke a SID history search when you click Add to add the selected group/user to the List of users and groups to revoke list. Since there may be more than one SID associated with the selected account, selecting this check box adds all existing SIDs to the List of users and groups to revoke list so that all existing permissions are revoked. Note: You also can use the Revoke SID History advanced task to easily revoke permissions.

Security Explorer 9.1 User Guide Explorer 8 Installation Guide 16 6. To add the group/user to the List of users and groups to revoke list, click Add. Note: If you double-click a group or user in the left pane, it is added automatically to the List of users and groups to revoke list with the selected permission settings To remove a selected user or group from the list, click Remove. Advanced Revoke Options If you select this check box, a warning message displays and the Revoke Folder Permissions dialog box becomes inactive, so the other users/groups and permissions you selected are not included in this action. To continue, click Yes. To activate the Revoke Folder Permissions dialog box, clear the Advanced Revoke Options check box. Revoke all unknown and deleted accounts Active only when the Advanced Revoke Options check box is selected. Select to revoke permissions on unknown or deleted accounts. Note: You also can use the Revoke Unknown advanced task to easily revoke permissions on unknown. Revoke all disabled accounts Active only when the Advanced Revoke Options check box is selected. Select to revoke permissions on all disabled accounts. Note: You also can use the Revoke Disabled advanced task to easily revoke permissions on disabled accounts. Log Actions Active only when the Advanced Revoke Options check box is selected. Select to create a log file. Click to name the file. Include protected objects (objects with Inherit Permissions from Parent disabled) Select to revoke permissions on protected objects. 7. Click OK. The Revoking Permissions box displays the progress. See Completing a Process.