Contents

1. Installing Lepide Protect

1.1 Requirements and Prerequisites

Before you start using Lepide Protect, you need to ensure that you meet the following requirements:

• File Server Configuration: Ensure the file servers are properly configured within the system. This is essential for managing permissions effectively in the domain you are setting up for permission management.

winrm set winrm/config/client @{TrustedHosts="*"}

 winrm set winrm/config/client @{TrustedHosts="192.168.1X.1XX"}

• Successfully Scanned Dataset under CPA: Run a comprehensive scan using the Current Permission Analysis (CPA) feature to identify excessive permissions and populate the dataset with actionable insights.

• CPA User Privilege: The user running policies in CPA must be a Domain Administrator OR should have privileges to read and change permissions of folders included in policy. This user will be responsible for applying the denial of excessive permissions.

• Domain: The domain which is used to set up the CPA Dataset Scan should be the same as the one used to configure Lepide Protect to get the scanned folders.

1.2 Super Admin Privileges

Lepide Protect requires that a single administrator with Super Admin Privileges is assigned to oversee and manage permissions for each domain.

This approach ensures:

• Clear Accountability: One designated admin is responsible for all permissions management

• Streamlined Operations: This simplifies the process by avoiding overlapping roles and duplication

• Consistent Policy Application: It ensures all policies are uniformly implemented across the domain

To assign this user:

• From the Web Console Home screen, choose the Settings icon

  

• The Admin Console screen is displayed:

• Scroll down the Categories section and click on Lepide Protect

The Configure Super Admin Privilege screen will be displayed:

• Select Super Admin Privileges. This will display a list of all Super Admins configured in the main console.

• Select the single user who will have sole responsibility for setting permissions for a domain. This designated admin user will have the authority to oversee and control domain permissions.

• Click Apply

This feature eliminates confusion, enhances operational efficiency, and ensures effective permission management.

1.3 Email Configuration

The Email Id needs to be configured to provide sender email details. Emails will be sent to notify users of changes to permissions.

• Configure the following options:

  • Check the Multi-Factor Authentication box if required

  • Display Name

  • Sender’s Email Id

  • Server Name/IP

  • Port

  • Check the Requires authentication box if required

  • Logon Name

  • Password

  • Server Name/IP

  • Port

  • Check the Requires a secure connection (SSL) if required

• Select Send a Test Email to check that all the settings have been added correctly

• Click Save when finished

1.4 Configuration Capabilities

Lepide Protect is designed to meet the needs of modern businesses by offering three easy-to-use configuration methods for integrating users into the system:

• HRMS (Human Resource Management System) Integration: Lepide Protect supports HRMS platforms like Zoho and Workable which will fetch hierarchical user data directly from these systems. This data is then compared with records in Active Directory (AD) to create an accurate hierarchy, from super admins to employees. Once synchronized, the user data is uploaded into team management automatically.

HRMS integration is fully customizable. To add an HRMS platform that isn’t currently supported, please refer to the Lepide Support Team for assistance.

• Active Directory Integration: By validating domain credentials, Lepide Protect accesses and syncs user hierarchies from Active Directory. This ensures that your organizational structure in AD is accurately reflected within the Lepide Protect Team Management Module.

• CSV-Based Customization: For organizations that need more flexibility, Lepide Protect allows importing customized user data through CSV files. This feature enables you to define fields like managers, departments, and job titles, ensuring the system adapts to your unique team structure.

1.4.1 Steps to Configure Capabilities for HRMS

• Select Lepide Protect

• Select HRMS

• Select the HRMS system required and follow the steps for setup

To generate the Client ID and Secret Key for HRMS, click the

1.4.2 Steps to Configure Capabilities for CSV

• Select Lepide Protect

• Select CSV

• Select the CSV file and follow the steps for setup. The steps will be similar to the Active Directory setup shown in the following section.

1.4.3 Steps to Configure Capabilities for Active Directory

• Select Lepide Protect

• Select Active Directory

• The Active Directory screen will be displayed:

• Click the Add Active Directory button

Adding Active Directory will integrate the Active Directory users with Lepide Protect to allow us to allocate the permissions for the files and folders

• Enter the following details:

  • Domain Name/IP address

  • User Name – note: this should be the SAM account name

  • Password

• Click Next

All the AD users will now be integrated into Lepide Protect and displayed in the integration page:

• The Integration Page displays the Display Name, sAMAccount Name, Email and Manager for each user.

• The Email address and Manager name can be edited on this page if required. When editing the Manager name, it is better to use their sAMAccount Name rather than the Display Name as this will always be unique.

• Click Next

The following dialog box will be displayed if duplicate emails are found:

• Click either Proceed Anyway or Go Back and Edit to continue

The following dialog box will be displayed:

• This gives you the option to download user details to a CSV file. With a large number of users, this can make it much easier to filter, sort and edit the user details.

• If this option is selected, the changes can be made in the CSV file and then this CSV file can be uploaded here with the updated details using the Upload button:

  

• Clicking the Upload button will display a list of CSV files. Select the required file and click Open

• Click Download User details (CSV) if required or check the Continue without uploading CSV file

• Click OK

The Scan Settings page is displayed:

• This page allows you to sync the configuration setup for team management which means it will retrieve information from AD and display the users and managers as a hierarchical structure to make it easier to see who manages who.

Select Sync Now to start scanning now

Or

Select Schedule Sync to specify a schedule to regularly sync this information

• Once any changes are verified, click Finish to update Lepide Protect

1.4.4 Updating Details Manually

If a change needs to be made to Lepide Protect before the next scheduled scan, the changes can be made in the Integration Page and then the Sync Now option can be selected to update Lepide Protect.

2 Team Management

The Team Management Wizard simplifies the process for Super Admins to manage user hierarchies configured through the Permission Management Module. It provides a clear view of the organizational structure and supports the following key activities:

User Enrolment:

• User enrolment allows the Super Admin to delegate responsibility for permissions management to the specified manager of their team. This means that the manager, who will know the roles and requirements of their team, can allocate permissions accordingly.

• Enabling access in this way to managers affects Lepide Protect features only, without affecting console-wide privileges

Action Management: Allow managers to execute assigned policies and receive email notifications for updates and actions.

User Un-enrolment: Unassigned roles and remove users from the ability to run policies

This streamlined approach ensures managers and team members have the tools they need to maintain proper access control efficiently.

• Hover over Lepide Protect and the following menu options are displayed:

• Select Team Management

The team management screen is displayed:

This screen shows the single Super User responsible for all permissions management at the top of the hierarchy. Below this are the managers of the different teams and individual users. Click the ‘+’ icon next to the manager to expand the team and view the team members. There could be further managers within these groups which can be expanded and viewed in a similar way.

The Team Management screen has the following options:

The icons next to the Manager name represent the following:

2.1 Action

The Apply Least Privilege action will be applied when a scan is run

2.2 Enroll

Enrolling a Team Manager means that permissions management has been delegated to them for their particular team. Once enrolment has been selected, the relevant manager will receive an email to inform them that they now have authority to log into Lepide Protect and manage permissions for their team members.

• To enroll a Team Manager, check the Enroll box

• Click Apply

To see the managers who have been enrolled, select Role Management and the Role column will show their user role and their Lepide Protect role will be shown next to this:

• In the example above, Arjun has a Role of Data Viewer which can be switched to Admin if required. The other role is Protect Manager for Lepide Protect which cannot be changed here and so is disabled.

2.3 Exclude a Team or a User

To exclude a Team or a User from having a policy applied to them, check the Exclude box next to the Team or User. This provides an easy way to specify any teams or users that you want to exclude from a particular policy. Once the policy has been configured, the Exclude box can be unchecked.

To exclude a team or user:

• Check the box in the Exclude column for the relevant user or team

• Click Apply

• The user or team will be excluded temporarily from Policy Management

• When a user or team has been excluded there will be a green icon showing this. Clicking the icon will display a list of those Excluded:

• Check the box again to remove the Exclude option and the user or team will be included again

3. Policy Management

The Policy Management module in Lepide Protect provides a comprehensive set of tools to manage user permissions effectively. It enables you to create, execute, and manage policies across users while ensuring data integrity and compliance.

Note: Before Policy Management can be configured, the users need to have been configured as described previously in this document. Also a File Server scan needs to have been configured for auditing and a File Server scan needs to have been run.

• Hover over Lepide Protect and the following menu options are displayed:

• Select Policy Management
  The Policy Management screen is displayed:
  

Lepide Protect allows you to create customized policies for specific actions. The process includes:

• Selecting the target users enrolled in team management

• Defining the policy name, action type, and timeframe for capturing excessive permissions

• Choosing the file server and folder sections fetched from the CPA scan from the legacy console

3.1 To Create a New Policy

• Click Create Policy

The Create Policy screen is displayed:

• Enter a Policy Name and optional Description

• Select Criteria

• The Criteria drop down menu has the following options:

  • Members are those directly reporting to the manager

  • Managers are all designated managers

  • Whole Hierarchy applies to everyone below the current manager

• Select the Period of Action This refers to the number of days of inactivity to decide whether permissions should be removed. The default and recommended number for this is 30 days.

• Click Next

The list of servers and folders is displayed:

• Select the shares as required by checking the relevant box(es)

• Click Next

• Policies can be executed manually via the Start Scan feature or scheduled for automatic execution (weekly or monthly).

• Click Finish

The Policy will be displayed in the Policy Management page:

• Here the Policy Status shows that the scan is complete.

3.2 Failed Reports

• If a policy fails or partially executes for specific users, a detailed report is generated. This includes:

• The reason for the failure.

• The exact file path or action that caused the issue

• The failed report is available by clicking the

  

  icon and choosing Failed Report from the menu.

3.3 Edit Policy

Easily modify the options selected during the policy creation process, allowing you to update user lists, actions, or schedules as required.

• Click the

  

  and select Edit from the menu:

3.4 Remove Policy

• To remove a policy that is no longer needed, select Remove from the Action menu.

3.5 Restore Policy

Every successful policy execution generates a backup of the changes made by the policy automation. This ensures you can easily restore any changes using the backup.

• Backup retention is configurable under Permission Management settings:

  • Minimum: 2 backups

  • Default: 5 backups

  • Maximum: 12 backups

To restore a Policy select Restore from the Action menu:

The following message will be displayed:

• Select a backup by date and click Restore

• Please refer to the Policy Restoration Mechanism Section for full details on how this works.

4. Protect Dashboard

The Protect Dashboard serves as your central command center for permission management, offering real-time insights through six powerful graphs. Each visualization helps you make informed decisions about your organization's security posture.

• To view the Protect Dashboard, from the Dashboards page select Protect

4.1 Least Privileges by Shared Folder across File Server

This dynamic graph provides a comprehensive view of permission distribution:

• Upper Line: Shows total permissions before policy implementation

• Lower Line with Red Ticks: Displays permissions removed through automation

• Interactive Features: Click any file server to drill down into specific folders

• Use Case: Identify high-risk folders with excessive permissions to prioritize your security efforts

• Business Value: Target your permission cleanup efforts where they matter most

• Best Practice: Review weekly to track permission reduction progress

4.2 Top Users with Least Privileges on Each File Server

This crucial visualization highlights permission hotspots by user:

• Red Ticks: Indicate excessive permissions per user

• Interactive Elements: Click data points to see detailed user permission breakdowns

• Sorting: Users ranked by number of excessive permissions

• Use Case: Identify users who need immediate permission review

• Action Items: Create targeted policies for users with high red tick counts

• Risk Mitigation: Focus on users with the most significant security impact

4.3 Comprehensive Policy Overview

Track your policy implementation success with this detailed graph:

• Policy Status: View created, pending, and executed policies

• Execution Tracking: Monitor policy completion rates

• Success Metrics: Track policy effectiveness over time

• Resource Planning: Optimize policy creation and execution schedules

4.4 Folder Risk Reduction by Policy Action

Monitor the impact of your security measures over time:

• Three-Month Timeline: Track risk reduction trends

• User Impact: See how many users are affected by each policy

• Action Types: Break down different types of permission changes

• Progress Tracking: Measure risk reduction effectiveness

• ROI Visualization: Demonstrate security improvement value

• Compliance Monitoring: Track progress toward security goals

4.5 Stale Users across File Server

Identify and manage inactive user accounts efficiently:

• Active Directory Status: Track user activity states

• Server Distribution: See stale user concentration by server

• Risk Assessment: Identify potential security vulnerabilities

• Clean-up Opportunities: Find quick wins for permission removal

• Trend Analysis: Monitor stale user accumulation over time

• Action Planning: Prioritize user account clean-up efforts

4.6 Team Management Insights

Get a clear picture of your team's permission management structure:

• User Status: Track configured, enrolled, and excluded users

• Team Structure: Visualize organizational hierarchy

• Enrolment Trends: Monitor team participation rates

• Coverage Analysis: Identify gaps in team enrolment

• Management Efficiency: Optimize team structure and roles

5. Additional Features that Enhance Permission Management

Lepide Protect offers several features to streamline and improve the efficiency of permission management:

In-App Notifications: Stay updated on all important actions and events directly within the app. Real-time notifications ensure you never miss critical updates or changes.

• Email Notification: Receive detailed email alerts for important actions, policy executions, or failed reports. This feature keeps users informed, even when they are away from the app.

• Default Policy: The Default Policy is a pre-configured policy designed to simplify your initial setup. It provides a baseline for removing excessive permissions while still allowing customization to suit your specific needs.

5.1 Key Features

• Automated User Addition:
  When a scheduled configuration is run, newly added users from Active Directory (AD) or HRMS are automatically included in the default policy.

• One-Click Update:
  A single click on the Update button from the configuration page ensures that these new users are seamlessly added to the policy, streamlining the process and saving time.

The Default Policy ensures efficient permission management right from the start and adapts to changes in user data with minimal effort

Scheduling of Configurations: Automate configuration tasks by scheduling configurations. Set specific times for scans or policy executions to minimize manual intervention and ensure consistent results.

5.2 Policy Restoration Functionality

5.2.1 Overview

Policy Restoration enables users to revert folder permission changes to a previously executed policy. Each time a policy is executed, a backup is created that records only the changes (users affected) on that specific run. Restoring to any previous backup removes all changes made on and after that backup, resetting the policy to its prior state.

5.2.2 Restoration Behavior

• Each backup captures the delta — i.e., only the users whose permissions were modified in that execution.

• When restoring to a selected backup (e.g., Day N), the system removes all user permission changes applied on Day N and after.

• The result is a rollback to the exact state that existed before Day N.

Example:

• Remove permissions for User3 (Day 2), User4 (Day 3), User5 (Day 4), and User6 (Day 5)

• Revert the policy state to only User1 and User2 as denied (from Day 1)

Key Functional Rules

• Delta-based execution: Each backup holds only the users affected during that specific execution

• Subtractive restoration: Restoration removes all users added in and after the selected backup day

• Non-cumulative: Backups are not merged or overlaid. Only the state prior to the selected backup is restored

• Restoration is final: Once restored, the current state is locked and shown as the active state until another backup is applied

Backup Management Policy

Functional Capabilities

• Jump Restoration: Users can restore to any backup, regardless of order — including older or newer backups.

• Flexible Rollback: Supports both backward and forward restoration based on available backups.

• Audit Traceability: Each backup clearly shows which users were denied in that run for auditing and review.

• Backup Deactivation: Once restored, the same backup cannot be restored again unless re-executed.

Summary
The Policy Restoration feature offers precise rollback control for permission states, maintaining operational integrity and compliance. It is designed to be predictable, traceable, and adaptable to administrative workflows that require accurate undoing of permission changes.