Skip to main content

Proxy Mode as a Service Permissions

When you run File System scans in proxy mode as a service, two methods are available for deploying the service:

  • Pre-Installed File System Proxy Service – File System Proxy Service installation package must be installed on the Windows proxy servers before executing the scans. This is the recommended method.
  • Ad Hoc File System Proxy Service Deployment – File System Proxy Service is installed on the Windows proxy server when the job is executed

The proxy server where the service runs conducts data collection processing and uses a local mode-type scan to each of the target hosts. The final step in data collection is to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Access Analyzer Console server.

File System Proxy Service Credentials

You can run the service either as LocalSystem or with a domain account supplied during the installation of the File System Proxy Service with the following permission on the proxy server:

  • Membership in the local Administrators group
  • Granted the Log on as a service privilege (Local Security Policies > Local Policies > User Rights Assignment > Log on as a service)

Additionally, the credential must have WRITE access to the …\StealthAUDIT\FSAA folder in the installation directory.

Sensitive Data Discovery Auditing Consideration

Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later. If running Sensitive Data Discovery (SDD) scans, you must increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans are configured to run two concurrent threads. For example, if the job is configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are required (8x2x2=32).

Secure Proxy Communication Considerations

For secure proxy communication via https, a credential is supplied during installation to provide secure communications between the Access Analyzer server and the proxy server. This credential must be a domain account, but no additional permissions are required. Use the same domain account configured to run the proxy service as the credential in the Connection Profile that the File System Solution uses.

Secure Proxy Communication and Certificate Exchange

For Proxy Mode as a Service Scans, the certificate exchange mechanism and certificate exchange port must be configured via the File System Access Auditing Data Collector Wizard before executing a scan. See the FSAA Applet Certificate Management Overview topic for additional information.

See the Proxy Mode as a Service Port Requirements topic for firewall rule information.

Accounts Used​

  • Job Execution: Scheduled Task or Console User (launches the job)
  • Console ↔ Proxy: NAA Computer Account (Kerberos)
  • Target Access (Proxy ↔ Targets): Connection Profile Account
note

If the service is deployed by the File System Scan job (as opposed to manually installed), the account used by the connection profile will be used to run the FSAA Proxy Service unless Run service as Local System is checked on the Applet Settings page of the job query. Alternatively, you can add a credential to the connection profile using either Task (Local) or Task (Domain) to run the service.

If the target host resides in a different domain than the proxy server and there is no trust relationship between the two domains, you must stack a task credential for the proxy domain with the credential for scanning the target file system.

For example: Scanning Configuration: NAA Console [Domain A] → Proxy Server [Domain A] → File Server [Domain B] Connection Profile:

Active Directory Account | Domain B\Credentials Task (Domain) | Domain A\Credentials

Verify Proxy Mode with Service scanning​

To verify Proxy Mode with Service scanning, check the FSAA Data Collector Query Settings:

Pre-Install File System Proxy Service​

  1. Applet Settings > Applet Launch Mechanism: Require applet to be running as a service on target
  2. Scan Server Selection > “Specific Remote Server: “ OR “Specific Remote Servers by Host List”

OR

Deploy Service on Scan​

  1. Applet Settings > Applet Launch Mechanism: Windows Service
  2. Scan Server Selection > “Specific Remote Server: “ OR “Specific Remote Servers by Host List”