Summary

This report utilizes the new added file content hash feature of version 4.0.  The 4.0 scan policy definition gives a new option to Generate file content hashes for All Files or Files uploaded since the last scan.  This option prompts the AgentFS to generate a SHA256 hash of the file content and store the hash in the database where it can be compared against other files that match in content.

New with version 4.1 is the ability to manage the report paths outside of the query via the Report Designer. 

Summary

Create a report to locate all of the directly assigned user permissions in a particular NCP scan target.

Back Story

The customer has a number of volumes where the trustees should only ever be assigned granted via groups. They need a report to locate any permissions that have been granted to the individual user object, so that it can be evaluated.

Information

The scope of the query to limited to NCP trustees in the desired scan target. The scan_target will need to be modified to make it work based on the environment.

Summary

How when using the srs.current_ntfs_aces view can I report on the ACEs without inheritance?

Explaination

The srs.current_ntfs_aces view includes a field called ace_flags which is a value mask.

If the bit flag with a value of 16 is present, then the ACE is inherited. Filtering out inherited ACEs is a simple matter of checking that this flag is off.

Summary

Create a report that will display all NCP Trustees in eDirectory.

Back Story

The customer wanted to create a catalog of the NCP trustees for reference purposes.

Information

The scope of the query is eDirectory Tree wide, but can be limited to a particular path by adding a simple where clause.

*Starting in version 2.6.0, the "srs.active_ncp_trustees" database view has been renamed to "srs.current_ncp_trustees". While the "active" version will still with version 3.0 work it has been deprecated.

This code finds files within a scan target where the owner is either NULL, [Nobody], [Supervisor], or [UNKNOWN] instead of an FDN in eDirectory.

Find files where the owner is an unresolved or orphaned SID.  Just change the scan_target line to make the query work for your environment.

A customer asked for a query to find filenames that are too long, and might cause issues when migrating files from eDirectory to AD. The customer requested that query find filenames longer than 128 characters. The filename length to be reported by changing line 12, and the scope can limited by adding sd.scan_target = '\\server\share' to the where clause. 

Note: If you have downloaded an older version of the is query and have moved to version 3.5 of the product, the old active_fs_scandata views have been replaced with current_fs_scandata.

Summary

Over the past few years computer systems everywhere have been dealing with ransomeware viruses. Crypo, Wanna Cry, and others have hit networks all over the world. How can I find these infected files, so I can restore them from back up?