Data breaches are a serious threat to any organization and action needs to be taken to keep the risk of their occurrence to a minimum. When a user, either intentionally or accidentally, misuses legitimate privileges they have been granted it is known as privilege abuse. Despite these privileges being legitimately granted, users may access resources or perform actions that compromise data security. Whether privilege abuse occurs through users purposefully mishandling data, or through employee carelessness, it is a security threat that must be taken seriously.
It is essential, therefore, to track who has access to what data on Windows File Servers. Here are two ways to track this information and they are described below.
- Using the PowerShell Script
- Using the Lepide Auditor
Detect Who has Access to What Data on File Severs Using PowerShell
Please follow the below steps:
- Open Powershell ISE
- Create a new script with the following code (define the path on the file server and the name of the user):
dir -Recurse \\Multicorp | where {$_.PsIsContainer } | % { $path1 = $_.fullname; Get-Acl $_.Fullname | % { $_.access |where {$_.IdentityReference -like "Multicorp\Paul" -or $_.IdentityReference -like "Multicorp\Russell" } | Add-Member -MemberType NoteProperty '.\Application Data' -Value $path1 -passthru }} | Export-Csv "C:\Access.csv" - Run the script
- Open the output file in CSV:
Audit Who has Access to What Data on File Severs Using the Lepide Auditor
The Lepide Auditor for File Server overcomes the complexity of the native method by providing a straightforward way to report on who has access to what data on Windows FS using the Permissions by User Report:
Please follow the below steps:
- Click the Permissions & Privileges icon and choose Permissions by User
- Select the user or group, the required file server and click Generate Report
- The report shows user access to folders and files along with sensitive content in the files
- How the user is getting access can be further explored by showing direct, indirect, and inherited permissions
