diff --git a/docs/accessanalyzer/11.6/install/application/upgrade/overview.md b/docs/accessanalyzer/11.6/install/application/upgrade/overview.md index 63bfc607b0..bd710d6544 100644 --- a/docs/accessanalyzer/11.6/install/application/upgrade/overview.md +++ b/docs/accessanalyzer/11.6/install/application/upgrade/overview.md @@ -11,14 +11,14 @@ that are no longer supported, contact [Netwrix Support](https://www.netwrix.com/ assistance. :::note -If a Netwrix Engineer has made any customizations, ensure custom work isn't lost during the +If a Netwrix Engineer has made any customizations, ensure you preserve the custom work during the upgrade process. The Upgrade Wizard archives customizations before solution upgrades. These archives are available after the solution upgrades finish. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional information. ::: -This document provides the basic steps needed for upgrading Enterprise Auditor +This document provides the basic steps for upgrading Enterprise Auditor and the stock solutions. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional information. @@ -35,25 +35,25 @@ schema, corruption to Enterprise Auditor’s system tables can result. **SQL Server Supported Version Change for the Enterprise Auditor Database** -With the release of Enterprise Auditor v11.6, SQL Server 2016 through SQL Server 2022 are the +With the release of Enterprise Auditor v11.6, SQL Server 2016 through SQL Server 2025 are the supported versions for the Enterprise Auditor database. -To grant access to additional Solutions in an existing Enterprise Auditor installation, a new -license key is required. To update the Enterprise Auditor license key without installing a new +Granting access to additional Solutions in an existing Enterprise Auditor installation requires a +new license key. To update the Enterprise Auditor license key without installing a new version of the Enterprise Auditor Console, see the [Update License Key](/docs/accessanalyzer/11.6/install/application/updatelicense.md) topic for instructions. **License Key Changes** -The following changes in licensing requires the organization needing a new key: +The following licensing changes require the organization to get a new key: - Enterprise Auditor v11.6 - - No additional licenses are required for this version + - This version requires no additional licenses - StealthAUDIT v11.5 - - No additional licenses are required for this version + - This version requires no additional licenses - StealthAUDIT v11.0 - The new Data Privacy functionality is now a licensable feature. - All database platforms are available as part of a single SQL license. diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md b/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md index 901fcdbf8d..fcb628b9a1 100644 --- a/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md +++ b/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md @@ -37,6 +37,7 @@ topic for information on the required prerequisites. You can install the File System Proxy Service for the Enterprise Auditor File System Solution on the following Windows operating systems: +- Windows Server 2025 - Windows Server 2022 - Windows Server 2019 - Windows Server 2016 @@ -65,15 +66,16 @@ Two options are available for implementing the proxy scanning architecture: When you run File System scans in proxy mode with applet, Enterprise Auditor deploys the File System applet to the Windows proxy server when the job runs to conduct data collection. The proxy -server where the applet is deployed initiates the data collection processing and uses a +server hosting the applet initiates the data collection processing and uses a local mode-type scan to each of the target hosts. The final step in data collection is to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Enterprise Auditor Console server. ![Diagram of Enterprise Auditor server sending an FSAA applet to a proxy server](/images/accessanalyzer/11.6/install/filesystemproxy/proxymodewithapplet.webp) -The diagram illustrates the Enterprise Auditor server sending an FSAA applet to a proxy server, -which runs the scan against a file server, and then returns data to the Enterprise Auditor server. +The diagram illustrates the Enterprise Auditor server sending a FileSystemAccess (FSAA) applet to a +proxy server, which runs the scan against a file server, and then returns data to the Enterprise +Auditor server. ### Proxy Mode as a Service @@ -107,8 +109,8 @@ The diagram illustrates the Enterprise Auditor server communicating securely wit on a proxy server, which runs the scan against a file server, collecting the data locally and securely. Then the proxy service returns data securely to the Enterprise Auditor server. -When you initiate a proxy mode scan from the Enterprise Auditor Console, it distributes hosts to -be scanned across all proxy hosts. Enterprise Auditor monitors the scans from the central console. +When you initiate a proxy mode scan from the Enterprise Auditor Console, it distributes hosts for +scanning across all proxy hosts. Enterprise Auditor monitors the scans from the central console. Once all proxy hosts complete scanning, they return all results and SQLite databases to the Enterprise Auditor Console server. diff --git a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md index d8f17aab83..a8621e2aa4 100644 --- a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md +++ b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md @@ -7,7 +7,7 @@ sidebar_position: 40 # Sensitive Data Discovery Add-On Installation The Sensitive Data Discovery Add-On enables Enterprise Auditor to scan files for criteria matches -which indicate the existence of sensitive data. You can run Sensitive Data Discovery scans against +that indicate sensitive data. You can run Sensitive Data Discovery scans against Windows file system servers, Network Attached Storage (NAS) devices, SharePoint on-premises, SharePoint Online, OneDrive for Business, DropBox for Business, SQL Server databases, and Exchange mailboxes. @@ -21,7 +21,7 @@ The version of the SharePoint Agent must also match the major version of Enterpr You can install the Sensitive Data Discovery Add-On on the following servers: -- Windows Server 2016 through Windows Server 2022 +- Windows Server 2016 through Windows Server 2025 - On the Enterprise Auditor Console Server - On the Windows proxy server hosting the File System Proxy service - See the diff --git a/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md b/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md index 1092a69d52..feeda8d321 100644 --- a/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md +++ b/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md @@ -11,14 +11,15 @@ database environments to collect permissions, sensitive data, and activity event - Azure SQL -- SQL Server 2022 +- SQL Server 2025 +- SQL Server 2022 - SQL Server 2019 - SQL Server 2017 - SQL Server 2016 **Target SQL Server Requirements** -The following are requirements for the SQL Server to be scanned: +The target SQL Server must meet the following requirements: - WINRM Service installed - Ensure the following rights are in the `ROOT\Microsoft\SQLServer` and `ROOT\Interop` WMI @@ -35,7 +36,7 @@ The following are requirements for the SQL Server to be scanned: - For Activity Auditing – SQL Server Audit: - - SQL Server Audit Specifications to be configured on the target databases + - Configure SQL Server Audit Specifications on the target databases - Audit destination must be a binary file - See the Microsoft [Create a server audit and database audit specification](https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/create-a-server-audit-and-database-audit-specification) @@ -79,9 +80,9 @@ This solution employs the following data collector to scan the target environmen - For permissions for data collection: - Read access to SQL instance - - Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the - target SQL instances when using the **Scan full rows for sensitive data** option on the - Options wizard page + - Requires the SQL Full-Text and Semantic Extractions for Search feature on the target SQL + instances when you use the **Scan full rows for sensitive data** option on the Options + wizard page - Grant Authenticate Server to [DOMAIN\USER] - Grant Connect SQL to [DOMAIN\USER] - Grant View any database to [DOMAIN\USER] @@ -111,4 +112,4 @@ The following firewall ports are needed: **For SQL Data Collector** -- Specified by Instances table (default is 1433) +- The Instances table specifies the port (default is 1433) diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md index 9ba731e576..470876247b 100644 --- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md +++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md @@ -19,7 +19,7 @@ Access Auditing and Sensitive Data Discovery Auditing support CIFS and NFSv3. ::: -Ports and permissions vary based on the scan mode option selected as well as the target environment. +Ports and permissions vary based on the selected scan mode option and the target environment. **Data Collectors** @@ -52,13 +52,14 @@ The following firewall ports are needed: **Permissions and Ports for FileSystemAccess Data Collector** -- Permissions vary based on the Scan Mode Option selected. See the File System Supported Platforms +- Permissions vary based on the selected Scan Mode Option. See the File System Supported Platforms topic for additional information. ## Supported Windows Platforms The following are supported Microsoft® Windows® operating systems: +- Windows Server 2025 - Windows Server 2022 - Windows Server 2019 - Windows Server 2016 @@ -125,7 +126,7 @@ for target environment requirements. - Cluster-Mode 8.2+ :::note - The Resiliency feature introduced in ONTAP 9.0 isn't supported. + Enterprise Auditor doesn't support the Resiliency feature introduced in ONTAP 9.0. ::: diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md index a24b18c97a..e6b7c3ede5 100644 --- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md +++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md @@ -6,32 +6,31 @@ sidebar_position: 10 # Proxy Mode Server Requirements -The Enterprise Auditor File System Proxy requirements apply for servers where either the service is -installed or the applet will be deployed unless otherwise stated. +The Enterprise Auditor File System Proxy requirements apply for servers where you either install the +service or deploy the applet, unless otherwise stated. :::note -Align the proxy server requirements to match the environment size the proxy server will be -handling. +Align the proxy server requirements to match the size of the environment the proxy server +handles. ::: The server can be physical or virtual. The requirements for Enterprise Auditor are: -- Windows Server 2016 through Windows Server 2022 +- Windows Server 2016 through Windows Server 2025 - - US English language installation + - English (United States) language installation - Domain member **RAM, CPU, and Disk Space** -RAM, CPU, and Disk Space are dependent upon the size of the target environment: +RAM, CPU, and Disk Space depend on the size of the target environment: :::warning If running Sensitive Data Discovery (SDD) scans, you must increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By -default, SDD scans are configured to run two concurrent threads. For example, if the job is -configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are -required (8x2x2=32). +default, SDD scans run two concurrent threads. For example, a job configured to scan 8 hosts at a +time with two concurrent SDD threads requires an extra 32 GB of RAM (8x2x2=32). ::: @@ -65,9 +64,9 @@ required (8x2x2=32). - 2 CPU Cores - 130 GB Disk Space -This recommended disk space sizing information is based on the needs of Enterprise Auditor as -well as the File System solution for running Permission scans with the default configuration (500 -MB per million files and folders), that means no tag collection, file-level scanning, activity, or +This recommended disk space sizing information is based on the needs of Enterprise Auditor and +the File System solution for running Permission scans with the default configuration (500 +MB per million files and folders), which means no tag collection, file-level scanning, activity, or sensitive data. - For tag collection, add 125 MB per million documents to these totals @@ -77,8 +76,8 @@ sensitive data. total size of the documents scanned for sensitive data (depending on targeted document types and selected criteria) to these totals -For example, to scan 200 million files and folders, of which 10 million files will be -scanned for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for +For example, to scan 200 million files and folders, of which you scan 10 million files +for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for permission collection + 1.25 GB for tag collection (10x125 MB) + 100 GB for sensitive data collection (200x500 MB) + 600 GB additional for sensitive data collection (10% of 6 TB) = 861.25 GB Disk Space. @@ -90,7 +89,7 @@ The following are additional requirements for the server: - .NET Framework 4.7.2 Installed :::note - .NET Framework 4.7.2 can be downloaded from the link in the Microsoft + Download .NET Framework 4.7.2 from the link in the Microsoft [.NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2) article. ::: @@ -99,14 +98,14 @@ The following are additional requirements for the server: - Remote Registry Service enabled :::note - The Remote Registry Service only needs to be enabled when running Applet Mode or Proxy + You only need to enable the Remote Registry Service when running Applet Mode or Proxy Mode with Applet scans. ::: **Sensitive Data Discovery Auditing** -The following is required to run Sensitive Data Discovery scans: +Running Sensitive Data Discovery scans requires the following: - Sensitive Data Discovery Add-On installed on the proxy server diff --git a/docs/accessanalyzer/11.6/requirements/overview.md b/docs/accessanalyzer/11.6/requirements/overview.md index 9aec52fcac..4d79957ed5 100644 --- a/docs/accessanalyzer/11.6/requirements/overview.md +++ b/docs/accessanalyzer/11.6/requirements/overview.md @@ -7,65 +7,63 @@ sidebar_position: 20 # Requirements This topic describes the recommended configuration of the servers needed to install the application -in a production environment. Depending on the size of the organization, it is recommended to review -your environment and requirements with a Netwrix engineer before deployment to ensure all -exceptions are covered. +in a production environment. Depending on the size of your organization, review your environment +and requirements with a Netwrix engineer before deployment to ensure all exceptions are covered. ## Architecture Overview -The following servers and applications are required for installation of the application: +Installing the application requires the following servers and applications: **Core Components** -- Enterprise Auditor Console Server – This is where the v11.6 application is installed. -- SQL Server for Enterprise Auditor Database – As a data-intensive application, a well-provisioned, - dedicated SQL Server is recommended. -- Access Information Center Application Server – This application is typically installed on the - Enterprise Auditor Console server and is a browser-based, interactive dashboard for exploring +- Enterprise Auditor Console Server – This is where you install the v11.6 application. +- SQL Server for Enterprise Auditor Database – Because Enterprise Auditor is a data-intensive + application, Netwrix recommends a well-provisioned, dedicated SQL Server. +- Access Information Center Application Server – You typically install this application on the + Enterprise Auditor Console server. It is a browser-based, interactive dashboard for exploring permissions, activity, and sensitive data. :::note - The Access Information Center is often installed on the same server as the Enterprise - Auditor application, but it can be installed separately. + You often install the Access Information Center on the same server as the Enterprise + Auditor application, but you can install it separately. ::: **Add-on Component** -- Enterprise Auditor Sensitive Data Discovery Add-On – This application is installed on the +- Enterprise Auditor Sensitive Data Discovery Add-On – You install this application on the Enterprise Auditor Console server as an add-on enabling Sensitive Data criteria for scans. In some - cases it must also be installed on additional servers. See the + cases you must also install it on additional servers. See the [Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md) topic for additional information. **Exchange Solution-Specific Components** -- Enterprise Auditor MAPI CDO – This application is installed on the Enterprise Auditor Console +- Enterprise Auditor MAPI CDO – You install this application on the Enterprise Auditor Console server to enable the Settings > Exchange global configuration interface within Enterprise Auditor. **File System Solution-Specific Components** -- Enterprise Auditor File System Proxy Server – In certain environments, a proxy server may be - used to scan hosts in remote or firewalled sites to increase scan capacity in large - environments. This feature can be implemented through either an applet or a service. The applet - would be deployed as part of the data collection process. The service should be installed before - data collection. See the +- Enterprise Auditor File System Proxy Server – In certain environments, a proxy server can scan + hosts in remote or firewalled sites to increase scan capacity in large environments. You can + implement this feature through either an applet or a service: the applet deploys as part of the + data collection process, and you install the service before data collection. See the [Proxy Mode as a Service](/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/scanoptions.md#proxy-mode-as-a-service) topic for server requirements. -- Enterprise Auditor Sensitive Data Discovery Add-On – This application is installed on the file - system proxy server where the File System Proxy Service is installed as an add-on enabling +- Enterprise Auditor Sensitive Data Discovery Add-On – You install this application on the file + system proxy server that hosts the File System Proxy Service, as an add-on enabling Sensitive Data criteria for scans. **SharePoint Solution-Specific Components** -- Enterprise Auditor SharePoint Agent Server – For agent-based scans, this application can be - installed on the SharePoint application server that hosts the “Central Administration” component - of the targeted farms to auditing permissions, content, and sensitive data for SharePoint - On-Premise. See the +- Enterprise Auditor SharePoint Agent Server – For agent-based scans, you can install this + application on the SharePoint application server that hosts the “Central Administration” + component of the targeted farms to auditing permissions, content, and sensitive data for + SharePoint On-Premise. See the [SharePoint Scan Options](/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md) topic for server requirements. -- Enterprise Auditor Sensitive Data Discovery Add-On – This application is installed on the same - server where the Enterprise Auditor SharePoint Agent is installed as an add-on enabling Sensitive +- Enterprise Auditor Sensitive Data Discovery Add-On – You install this application on the same + server as the Enterprise Auditor SharePoint Agent, as an add-on enabling Sensitive Data criteria for scans. **Activity Event Data Considerations** @@ -82,24 +80,24 @@ The following servers and applications are required for installation of the appl **Target Environment Considerations** -The target environment encompasses all servers, devices, or infrastructure to be audited by -Enterprise Auditor. Most solutions have additional target requirements. +The target environment encompasses all servers, devices, or infrastructure that Enterprise Auditor +audits. Most solutions have additional target requirements. ## Enterprise Auditor Console & Access Information Center Server Requirements The server can be physical or virtual. The requirements are: -- Windows Server 2016 through Windows Server 2022 +- Windows Server 2016 through Windows Server 2025 Additionally the server must meet these requirements: -- US English language installation +- English (United States) language installation - Domain member **RAM, CPU, and Disk Space** -These are dependent upon the size of the target environment. See the following topics for -additional: +These depend on the size of the target environment. See the following topics for additional +information: - [Active Directory Solution Requirements on the Enterprise Auditor Console](/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory.md#active-directory-solution-requirements-on-the-enterprise-auditor-console) - [Active Directory Permissions Analyzer Solution Requirements on the Enterprise Auditor Console](/docs/accessanalyzer/11.6/requirements/activedirectorypermissionsanalyzer/activedirectorypermissionsanalyzer.md#active-directory-permissions-analyzer-solution-requirements-on-the-enterprise-auditor-console) @@ -118,7 +116,7 @@ additional: The following are additional requirements for the Console server: -- .NET Framework 4.7.2 installed, which can be downloaded from the link in the Microsoft +- .NET Framework 4.7.2 installed, which you can download from the link in the Microsoft [.NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2) article. - Microsoft SQL Server supports TLS 1.2, which requires the Enterprise Auditor Console server to @@ -139,7 +137,7 @@ The following permissions are required to install and use the application: - Membership in the local Administrators group for the Enterprise Auditor Console server :::note - Role based access can be enabled for a least privilege user model. + You can enable role based access for a least privilege user model. ::: @@ -155,17 +153,17 @@ The following is a list of supported browsers for the Web Console and the Access The server requirements include one of the following SQL Server versions: -- SQL Server 2016 through SQL Server 2022 +- SQL Server 2016 through SQL Server 2025 - Azure SQL Managed Instances Additionally the server must meet this requirement: -- US English language installation +- English (United States) language installation **RAM, CPU, and Disk Space** -These are dependent upon the size of the target environment. See the following topics for -additional: +These depend on the size of the target environment. See the following topics for additional +information: - [Active Directory Solution Requirements on the SQL Server](/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory.md#active-directory-solution-requirements-on-the-sql-server) - [Active Directory Permissions Analyzer Solution Requirements on the SQL Server](/docs/accessanalyzer/11.6/requirements/activedirectorypermissionsanalyzer/activedirectorypermissionsanalyzer.md#active-directory-permissions-analyzer-solution-requirements-on-the-sql-server) @@ -183,7 +181,7 @@ additional: The following are additional requirements for the SQL Server: -- SQL Server must be equal or newer version than the version to be targeted +- SQL Server must be an equal or newer version than the targeted version - All SQL Server databases configured to use ‘Simple Recovery Model’ **Additional Server Considerations** @@ -192,7 +190,7 @@ The following additional considerations are recommended for the SQL Server: - The standard Autogrowth setting can cause Enterprise Auditor job delays. Database growth is computationally intensive. While SQL Server is growing the database, no other activity can occur. - If this option is employed, speak with a Netwrix engineer to determine an appropriate + If you use this option, speak with a Netwrix engineer to determine an appropriate setting for best performance. - Microsoft SQL Server supports TLS 1.2, which requires the Enterprise Auditor Console server to have either SQL Server Native Client 11 or Microsoft OleDB 18 installed. @@ -207,10 +205,10 @@ The following permissions are required on the databases: ## Virtual Environment Recommendations -While physical machines are always preferred, virtual machines are fully supported. This -section contains special considerations when using virtualization. +While physical machines are always preferred, Enterprise Auditor fully supports virtual machines. +This section contains special considerations for virtualized environments. -- VMWare® ESX® – If using ESX, the following specifications are recommended: +- VMWare® ESX® – If you use ESX, Netwrix recommends the following specifications: - ESX 4.0 / ESXi™ 4.1 or higher - Virtual Hardware 7 or higher @@ -218,5 +216,5 @@ section contains special considerations when using virtualization. - Virtual Storage Consideration - - In the server requirements, when separate disks are required for the servers, that should - translate to separate data stores on the VM host machine. + - When the server requirements call for separate disks, use separate data stores on the VM + host machine. diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md index a241598c76..c819f5c8cd 100644 --- a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md +++ b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md @@ -6,20 +6,20 @@ sidebar_position: 10 # SharePoint Agent Permissions -When Enterprise Auditor SharePoint scans are run in agent-based mode, the Enterprise Auditor -SharePoint Agent must be installed on the SharePoint Application server which hosts the Central +When you run Enterprise Auditor SharePoint scans in agent-based mode, you must install the +Enterprise Auditor SharePoint Agent on the SharePoint Application server that hosts the Central Administration component before executing the scans. This is typically the first server deployed -during the SharePoint farm installation process in this mode. The data collection processing is -conducted by the SharePoint Agent for the target environment. The final step in data collection is +during the SharePoint farm installation process in this mode. The SharePoint Agent conducts the +data collection processing for the target environment. The final step in data collection is to transfer the data collected in the SQLite databases, or Tier 2 databases, on the Enterprise Auditor SharePoint Agent server back to the Enterprise Auditor Console server. -The Enterprise Auditor SharePoint Agent needs to be installed on the: +Install the Enterprise Auditor SharePoint Agent on the: - SharePoint Application server hosting the Central Administration component - SharePoint® 2013 through SharePoint® 2019 - - Windows® Server 2012 through Windows® Server 2022 + - Windows® Server 2016 through Windows® Server 2025 **Additional Server Requirements** @@ -31,7 +31,7 @@ The following are additional requirements for the Enterprise Auditor SharePoint **Sensitive Data Discovery Auditing Requirement** In addition to having the Sensitive Data Discovery Add-on installed on the Enterprise Auditor -Console server, The following is required to run Sensitive Data Discovery scans: +Console server, running Sensitive Data Discovery scans requires the following: - Sensitive Data Discovery Add-On, 64-bit version, installed on the Enterprise Auditor SharePoint Agent server @@ -40,23 +40,23 @@ Console server, The following is required to run Sensitive Data Discovery scans: :::note The Sensitive Data Discovery Add-on installation package installs the appropriate JDK (Java) version on the server. The JDK deployed is prepackaged and doesn't require any -configuration; it has been preconfigured to work with Enterprise Auditor and should never be -customized through Java. It will not conflict with other JDKs or Java Runtimes in the same +configuration. Netwrix preconfigures it to work with Enterprise Auditor, and you shouldn't +customize it through Java. It doesn't conflict with other JDKs or Java Runtimes in the same environment. ::: If running Sensitive Data Discovery (SDD) scans, you must increase the minimum amount -of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job -is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16). +of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if you +configure the job to scan 8 hosts at a time, you need an extra 16 GB of RAM (8x2=16). ## Permissions Explained -If limited provisioning of the service account isn't required by the organization, then the +If the organization doesn't require limited provisioning of the service account, then the following permissions are sufficient for successful agent-based scans: -- Membership in the local Administrator group on the on server where the Enterprise Auditor - SharePoint Agent is installed +- Membership in the local Administrator group on the server where you install the Enterprise + Auditor SharePoint Agent - Only needed for agent installation @@ -87,9 +87,9 @@ following permissions are sufficient for successful agent-based scans: content and more - If the group doesn't exist already, then you need to create a new group at that level and grant it Read access. Specifically, it is a group that exists within Central - Administration at the farm administrator level. This group only requires Read access and - isn't giving farm admin access. After the group is created, add the service account that - Enterprise Auditor will be leveraging to scan SharePoint. + Administration at the farm administrator level. This group requires only Read access and + doesn't grant farm admin access. After you create the group, add the service account that + Enterprise Auditor uses to scan SharePoint. - Web Application permissions: @@ -111,7 +111,7 @@ following permissions are sufficient for successful agent-based scans: content databases, and give read access around sites, roles, and users - DB_Owner on Enterprise Auditor database if using Windows Authentication for the Storage Profile -- MySites permissions are based on the SharePointAccess Data Collector configuration option: +- MySites permissions depend on the SharePointAccess Data Collector configuration option: - Forcing the service account to become a temporary admin of the personal sites either as the service account or as a member of the Company Administrators group requires SharePoint Farm @@ -120,14 +120,14 @@ following permissions are sufficient for successful agent-based scans: administrative access - This grants Enterprise Auditor rights to scan MySites -Additional permission models are explained for a less and least permission model. +The following sections explain the less privilege and least privilege permission models. ## SharePoint Agent-Based Less Privilege Permission Model -If restricted permissions are desired by the organization, then the following permissions are needed -for the service account to successfully run SharePoint Agent-based scans. +If the organization requires restricted permissions, then the service account needs the following +permissions to successfully run SharePoint Agent-based scans. -Before installation of the SharePoint Agent, the service account to be supplied during +Before installing the SharePoint Agent, the service account to be supplied during installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing scans against the targeted SharePoint environment needs the following permissions: @@ -138,18 +138,18 @@ scans against the targeted SharePoint environment needs the following permission After the SharePoint Agent installation, this service account needs the following additional permissions to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing scans: -- Site Collection Administrator on all Site Collections to be scanned +- Site Collection Administrator on all Site Collections you plan to scan - Membership in the local Users group on the server where the SharePoint Agent is installed - DB_Owner on Enterprise Auditor database if using Windows Authentication for the Storage Profile -If the scans include Web Application scoping, then the following permissions are needed (can be -skipped if running full farm scans): +If the scans include Web Application scoping, then the service account needs the following +permissions (you can skip these when running full farm scans): - Membership in the local Backup Operators group - Membership in the local WSS_WPG group - WSS_CONTENT_APPLICATION_POOLS on the SharePoint Configuration database -After the Enterprise Auditor SharePoint Agent is installed, ensure that the service account has the +After you install the Enterprise Auditor SharePoint Agent, ensure that the service account has the following permissions: - Full Control on the agent install directory, default path is: @@ -163,16 +163,16 @@ account with the following permissions to collect all of the data: - WSS_CONTENT_APPLICATION_POOLS on the SharePoint Configuration database :::note -If scans include Web Application scoping, this last permission requirement is already met. +If scans include Web Application scoping, you have already met this permission requirement. ::: ## SharePoint Agent-Based Least Privilege Permission Model -If a least privilege model is required by the organization, then the following permissions are -needed for the service account to successfully run SharePoint Agent-based scans. +If the organization requires a least privilege model, then the service account needs the following +permissions to successfully run SharePoint Agent-based scans. -Before installation of the SharePoint Agent, the service account to be supplied during +Before installing the SharePoint Agent, the service account to be supplied during installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing scans the targeted SharePoint environment needs the following permissions: @@ -183,12 +183,12 @@ scans the targeted SharePoint environment needs the following permissions: After the SharePoint Agent installation, this service account needs the following additional permissions to run the Access Auditing (SPAA) scans: -- Site Collection Administrator on all Site Collections to be scanned +- Site Collection Administrator on all Site Collections you plan to scan - Membership in the local Users group on the server where the SharePoint Agent is installed - DB_Owner on Enterprise Auditor database if using Windows Authentication for the Storage Profile -If the scans include Web Application scoping, then the following permissions are needed (can be -skipped if running full farm scans): +If the scans include Web Application scoping, then the service account needs the following +permissions (you can skip these when running full farm scans): - READ Access on the following registry keys: @@ -210,7 +210,7 @@ skipped if running full farm scans): - `proc_getDependentObjectsByBaseClass` - `proc_ReturnWebFeatures` -After the Enterprise Auditor SharePoint Agent is installed, ensure that the service account has the +After you install the Enterprise Auditor SharePoint Agent, ensure that the service account has the following permissions: - Full Control on the agent install directory, default path is: @@ -230,8 +230,8 @@ account with the following permissions to collect all of the data: - `proc_ReturnWebFeatures` :::note - These four stored procedures would already have the correct permissions if Web - Application scoping is desired. + These four stored procedures already have the correct permissions if you want Web + Application scoping. ::: diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md b/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md index 2ad8fe090b..d4d0d189af 100644 --- a/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md +++ b/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md @@ -6,7 +6,7 @@ sidebar_position: 70 # SQL Job Group -The SQL Job Group reports on SQL Server, AzureSQL, or both depending on which collection jobs were +The SQL Job Group reports on SQL Server, AzureSQL, or both depending on which collection jobs you run. The SQL Job Group is a comprehensive set of pre-configured audit jobs and reports that provide information on users and roles, activity, permissions, configuration, sensitive data, and overall security assessment. @@ -15,7 +15,8 @@ security assessment. - Azure SQL -- SQL Server 2022 +- SQL Server 2025 +- SQL Server 2022 - SQL Server 2019 - SQL Server 2017 - SQL Server 2016 @@ -28,27 +29,27 @@ topic for additional information. **Sensitive Data Discovery Considerations** -The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server, +You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server, which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, you must increase the minimum amount of RAM. Each thread requires a minimum of 2 -additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time, you +additional GB of RAM per host. For example, if you configure the job to scan 8 hosts at a time, you need an extra 16 GB of RAM (8 x 2 = 16). :::note The Sensitive Data Discovery Add-on installation package installs the appropriate JDK (Java) version on the server. The JDK deployed is prepackaged and doesn't require any -configuration; it has been preconfigured to work with Enterprise Auditor and should never be -customized through Java. It will not conflict with other JDKs or Java Runtimes in the same +configuration. Netwrix preconfigures it to work with Enterprise Auditor, and you shouldn't +customize it through Java. It doesn't conflict with other JDKs or Java Runtimes in the same environment. ::: **Location** -The SQL Job Group within the Jobs tree, as part of the Database Solution: Jobs > Database > SQL. +The SQL Job Group within the Jobs tree, as part of the Database Solution: Jobs > Database > SQL. -The Database Solution license includes all supported database platforms supported by Enterprise -Auditor. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database +The Database Solution license includes all database platforms that Enterprise Auditor +supports. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database content for sensitive data. ![SQL Job Group](/images/accessanalyzer/11.6/solutions/databases/sql/sqljobgroup.webp) @@ -57,31 +58,31 @@ The SQL Job Group includes: - Databases > 0.Collection > SQL > [0.Collection > SQL Job Group](/docs/accessanalyzer/11.6/solutions/databases/sql/collection/overview.md) - – This job group is designed to collect high level summary information from Microsoft SQL servers. - This information is used by other jobs in the SQL solution set for further analysis and for - producing respective reports. + – This job group collects high level summary information from Microsoft SQL servers. Other jobs + in the SQL solution set use this information for further analysis and for producing respective + reports. - Databases > 0.Collection > AzureSQL > [0.Collection > Azure SQL Job Group](/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/overview.md) - — This job group is designed to collect high level summary information from targeted Azure SQL - Instances. This information is used by other jobs in the Azure SQL solution set to provide further - analysis and for producing respective reports. + — This job group collects high level summary information from targeted Azure SQL Instances. Other + jobs in the Azure SQL solution set use this information to provide further analysis and to produce + respective reports. - [1.Users and Roles Job Group](/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/overview.md)– - This job group is designed to provide insight into user security, roles, and object permissions to + This job group provides insight into user security, roles, and object permissions to all the SQL server objects - [2.Activity Job Group](/docs/accessanalyzer/11.6/solutions/databases/sql/activity/overview.md) - – This job group is designed to provide insight into use login activity, object permission + – This job group provides insight into use login activity, object permission changes, any unusual database activity, SQL activity against sensitive data, SQL activity against selective or all database objects - [3.Permissions Job Group](/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/overview.md) - – This job group is designed to provide insight into all types of permissions at the instance, + – This job group provides insight into all types of permissions at the instance, database, and object level across all the targeted SQL servers - [4.Configuration Job Group](/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/overview.md) - – This job group is designed to provide insight into potential vulnerabilities related to SQL + – This job group provides insight into potential vulnerabilities related to SQL server configuration settings - [5.Sensitive Data Job Group](/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/overview.md)– - This job group is designed to provide insight into where sensitive data exists and who has access + This job group provides insight into where sensitive data exists and who has access to it across all the targeted SQL server databases - Requires the Sensitive Data Discovery Add-On. - [SQL_SecurityAssessment Job](/docs/accessanalyzer/11.6/solutions/databases/sql/sql_securityassessment.md) - – This job is designed to summarize and categorize the security findings into HIGH, MEDIUM, LOW, + – This job summarizes and categorizes the security findings into HIGH, MEDIUM, LOW, and NO FINDING categories based on their severity. diff --git a/docs/accessanalyzer/12.0/install/application/upgrade/overview.md b/docs/accessanalyzer/12.0/install/application/upgrade/overview.md index ad0bfe86a8..0da869265b 100644 --- a/docs/accessanalyzer/12.0/install/application/upgrade/overview.md +++ b/docs/accessanalyzer/12.0/install/application/upgrade/overview.md @@ -10,8 +10,8 @@ Access Analyzer 12.0 uses the Upgrade Wizard. For upgrades from versions of Acce no longer supported, contact [Netwrix Support](https://www.netwrix.com/support.html) for assistance. :::note -If a Netwrix Engineer has made any customizations, ensure the custom work is -not lost during the upgrade process. The Upgrade Wizard archives customizations +If a Netwrix Engineer has made any customizations, ensure you preserve the custom work +during the upgrade process. The Upgrade Wizard archives customizations before solution upgrades. These archives are available after the solution upgrades complete. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional information. @@ -57,14 +57,14 @@ have local administrator rights. Otherwise, Access Analyzer throws an exception Multiple Access Analyzer Consoles Connecting to the Same Database In environments where multiple Access Analyzer Consoles use the same SQL Server database, -you must also update every console that uses the database. The act of connecting a Access Analyzer -Console with a newer version to a database updates the database’s schema pursuant to the new -definition. If a Access Analyzer Console with an older version connects to the same database after +you must also update every console that uses the database. Connecting an Access Analyzer +Console with a newer version to a database updates the database’s schema according to the new +definition. If an Access Analyzer Console with an older version connects to the same database after you update the schema, corruption to Access Analyzer’s system tables can result. SQL Server Supported Version Change for the Access Analyzer Database -With the release of Access Analyzer v12.0, SQL Server 2016 through SQL Server 2022 are the supported +With the release of Access Analyzer v12.0, SQL Server 2016 through SQL Server 2025 are the supported versions for the Access Analyzer database. To grant access to additional Solutions in an existing Access Analyzer installation, you need a new diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md b/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md index 1bc291c52b..31cdcdb171 100644 --- a/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md +++ b/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md @@ -36,6 +36,7 @@ the required prerequisites. You can install the File System Proxy Service for the Access Analyzer File System Solution on the following Windows operating systems: +- Windows Server 2025 - Windows Server 2022 - Windows Server 2019 - Windows Server 2016 @@ -64,7 +65,7 @@ Two options are available for implementing the proxy scanning architecture: When you run File System scans in proxy mode with applet, Access Analyzer deploys the File System applet to the Windows proxy server when the job runs to conduct data collection. The proxy server -where the applet is deployed initiates the data collection processing and uses a +hosting the applet initiates the data collection processing and uses a local mode-type scan to each of the target hosts. The final step in data collection is to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Access Analyzer Console server. diff --git a/docs/accessanalyzer/12.0/requirements/databases/sql/sql.md b/docs/accessanalyzer/12.0/requirements/databases/sql/sql.md index c3ee20ae79..31784b1187 100644 --- a/docs/accessanalyzer/12.0/requirements/databases/sql/sql.md +++ b/docs/accessanalyzer/12.0/requirements/databases/sql/sql.md @@ -9,7 +9,8 @@ sidebar_position: 70 The Access Analyzer for Databases Solution lets you audit and monitor SQL Server database environments to collect permissions, sensitive data, and activity events. It scans: -- SQL Server 2022 +- SQL Server 2025 +- SQL Server 2022 - SQL Server 2019 - SQL Server 2017 - SQL Server 2016 @@ -33,7 +34,7 @@ The target SQL Server must meet the following requirements: - For Activity Auditing – SQL Server Audit: - - SQL Server Audit Specifications to be configured on the target databases + - Configure SQL Server Audit Specifications on the target databases - Audit destination must be a binary file - See the Microsoft [Create a server audit and database audit specification](https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/create-a-server-audit-and-database-audit-specification) @@ -77,9 +78,9 @@ This solution employs the following data collector to scan the target environmen - For permissions for data collection: - Read access to SQL instance - - Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the - target SQL instances when using the **Scan full rows for sensitive data** option on the - Options wizard page + - Requires the SQL Full-Text and Semantic Extractions for Search feature on the target SQL + instances when you use the **Scan full rows for sensitive data** option on the Options + wizard page - Grant Authenticate Server to [DOMAIN\USER] - Grant Connect SQL to [DOMAIN\USER] - Grant View any database to [DOMAIN\USER] @@ -106,4 +107,4 @@ The following firewall ports are needed: **For SQL Data Collector** -- Specified by Instances table (default is 1433) +- The Instances table specifies the port (default is 1433) diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md index f9705160a7..9d7f94a525 100644 --- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md +++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md @@ -19,7 +19,7 @@ Access Auditing and Sensitive Data Discovery Auditing support CIFS and NFSv3. ::: -Ports and permissions vary based on the scan mode option selected as well as the target environment. +Ports and permissions vary based on the selected scan mode option and the target environment. **Data Collectors** @@ -52,13 +52,14 @@ The following firewall ports are needed: **Permissions and Ports for FileSystemAccess Data Collector** -- Permissions vary based on the Scan Mode Option selected. See the File System Supported Platforms +- Permissions vary based on the selected Scan Mode Option. See the File System Supported Platforms topic for additional information. ## Supported Windows Platforms The following are supported Microsoft® Windows® operating systems: +- Windows Server 2025 - Windows Server 2022 - Windows Server 2019 - Windows Server 2016 diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md index d8dcb2a390..2e3ee74488 100644 --- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md +++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md @@ -6,32 +6,31 @@ sidebar_position: 10 # Proxy Mode Server Requirements -The Access Analyzer File System Proxy requirements apply for servers where either the service is -installed or the applet will be deployed unless otherwise stated. +The Access Analyzer File System Proxy requirements apply for servers where you either install the +service or deploy the applet, unless otherwise stated. :::note -Align the proxy server requirements to match the environment size the proxy server will be -handling. +Align the proxy server requirements to match the size of the environment the proxy server +handles. ::: The server can be physical or virtual. The requirements for Access Analyzer are: -- Windows Server 2016 through Windows Server 2022 +- Windows Server 2016 through Windows Server 2025 - - US English language installation + - English (United States) language installation - Domain member **RAM, CPU, and Disk Space** -RAM, CPU, and Disk Space are dependent upon the size of the target environment: +RAM, CPU, and Disk Space depend on the size of the target environment: :::warning If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By -default, SDD scans are configured to run two concurrent threads. For example, if the job is -configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are -required (8x2x2=32). +default, SDD scans run two concurrent threads. For example, if you configure the job to scan +8 hosts at a time with two concurrent SDD threads, you need an extra 32 GB of RAM (8x2x2=32). ::: @@ -65,9 +64,9 @@ required (8x2x2=32). - 2 CPU Cores - 130 GB Disk Space -This recommended disk space sizing information is based on the needs of Access Analyzer as well -as the File System solution for running Permission scans with the default configuration (500 MB -per million files and folders), that means no tag collection, file-level scanning, activity, or +This recommended disk space sizing information is based on the needs of Access Analyzer and +the File System solution for running Permission scans with the default configuration (500 MB +per million files and folders), which means no tag collection, file-level scanning, activity, or sensitive data. - For tag collection, add 125 MB per million documents to the preceding totals @@ -77,8 +76,8 @@ sensitive data. total size of the documents scanned for sensitive data (depending on targeted document types and selected criteria) to the preceding totals -For example, to scan 200 million files and folders, of which 10 million files will be -scanned for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for +For example, to scan 200 million files and folders, of which you scan 10 million files +for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for permission collection + 1.25 GB for tag collection (10x125 MB) + 100 GB for sensitive data collection (200x500 MB) + 600 GB additional for sensitive data collection (10% of 6 TB) = 861.25 GB Disk Space. @@ -90,7 +89,7 @@ The following are additional requirements for the server: - .NET Framework 4.7.2 Installed :::note - .NET Framework 4.7.2 can be downloaded from the link in the Microsoft + Download .NET Framework 4.7.2 from the link in the Microsoft [.NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2) article. ::: @@ -99,7 +98,7 @@ The following are additional requirements for the server: - Remote Registry Service enabled :::note - The Remote Registry Service only needs to be enabled when running Applet Mode or Proxy + You only need to enable the Remote Registry Service when running Applet Mode or Proxy Mode with Applet scans. ::: diff --git a/docs/accessanalyzer/12.0/requirements/overview.md b/docs/accessanalyzer/12.0/requirements/overview.md index 04f84dbeb5..061354adb6 100644 --- a/docs/accessanalyzer/12.0/requirements/overview.md +++ b/docs/accessanalyzer/12.0/requirements/overview.md @@ -12,26 +12,26 @@ and requirements with a Netwrix engineer before deployment to ensure all excepti ## Architecture Overview -The following servers and applications are required for installation of the application: +Installing the application requires the following servers and applications: **Core Components** -- Access Analyzer Console Server – This is where the v12.0 application is installed. +- Access Analyzer Console Server – This is where you install the v12.0 application. - SQL Server for Access Analyzer Database – Because Access Analyzer is a data-intensive application, use a well-provisioned, dedicated SQL Server for the database. -- Access Information Center Application Server – This application is typically installed on the - Access Analyzer Console server and is a browser-based, interactive dashboard for exploring +- Access Information Center Application Server – You typically install this application on the + Access Analyzer Console server. It is a browser-based, interactive dashboard for exploring permissions, activity, and sensitive data. :::note - The Access Information Center is often installed on the same server as the Access - Analyzer application, but it can be installed separately. + You often install the Access Information Center on the same server as the Access + Analyzer application, but you can install it separately. ::: **Exchange Solution-Specific Components** -- Access Analyzer MAPI CDO – This application is installed on the Access Analyzer Console server to +- Access Analyzer MAPI CDO – You install this application on the Access Analyzer Console server to enable the Settings > Exchange global configuration interface within Access Analyzer. **File System Solution-Specific Components** @@ -45,7 +45,7 @@ The following servers and applications are required for installation of the appl **SharePoint Solution-Specific Components** -- Access Analyzer SharePoint Agent Server – For agent-based scans, this application can be installed +- Access Analyzer SharePoint Agent Server – For agent-based scans, you can install this application on the SharePoint application server that hosts the “Central Administration” component of the targeted farms to auditing permissions, content, and sensitive data for SharePoint On-Premise. See the [SharePoint Scan Options](/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md) topic for server @@ -72,17 +72,17 @@ audits. Most solutions have additional target requirements. The server can be physical or virtual. The requirements are: -- Windows Server 2016 through Windows Server 2022 +- Windows Server 2016 through Windows Server 2025 Additionally the server must meet these requirements: -- US English language installation +- English (United States) language installation - Domain member **RAM, CPU, and Disk Space** -These are dependent upon the size of the target environment. See the following topics for -additional: +These depend on the size of the target environment. See the following topics for additional +information: - [Active Directory Solution Requirements on the Access Analyzer Console](/docs/accessanalyzer/12.0/requirements/activedirectory/activedirectory.md#active-directory-solution-requirements-on-the-access-analyzer-console) - [Active Directory Permissions Analyzer Solution Requirements on the Access Analyzer Console](/docs/accessanalyzer/12.0/requirements/activedirectorypermissionsanalyzer/activedirectorypermissionsanalyzer.md#active-directory-permissions-analyzer-solution-requirements-on-the-access-analyzer-console) @@ -101,7 +101,7 @@ additional: The following are additional requirements for the Console server: -- .NET Framework 4.7.2 installed, which can be downloaded from the link in the Microsoft +- .NET Framework 4.7.2 installed, which you can download from the link in the Microsoft [.NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2) article. - Microsoft SQL Server supports TLS 1.2, which requires the Access Analyzer Console server to have @@ -122,7 +122,7 @@ The following permissions are required to install and use the application: - Membership in the local Administrators group for the Access Analyzer Console server :::note - Role based access can be enabled for a least privilege user model. + You can enable role based access for a least privilege user model. ::: @@ -138,17 +138,17 @@ The following is a list of supported browsers for the Web Console and the Access The server requirements include one of the following SQL Server versions: -- SQL Server 2016 through SQL Server 2022 +- SQL Server 2016 through SQL Server 2025 - Azure SQL Managed Instances Additionally the server must meet this requirement: -- US English language installation +- English (United States) language installation **RAM, CPU, and Disk Space** -These are dependent upon the size of the target environment. See the following topics for -additional: +These depend on the size of the target environment. See the following topics for additional +information: - [Active Directory Solution Requirements on the SQL Server](/docs/accessanalyzer/12.0/requirements/activedirectory/activedirectory.md#active-directory-solution-requirements-on-the-sql-server) - [Active Directory Permissions Analyzer Solution Requirements on the SQL Server](/docs/accessanalyzer/12.0/requirements/activedirectorypermissionsanalyzer/activedirectorypermissionsanalyzer.md#active-directory-permissions-analyzer-solution-requirements-on-the-sql-server) @@ -166,7 +166,7 @@ additional: The following are additional requirements for the SQL Server: -- SQL Server must be equal or newer version than the version to be targeted +- SQL Server must be an equal or newer version than the targeted version - All SQL Server databases configured to use ‘Simple Recovery Model’ **Additional Server Considerations** @@ -190,10 +190,10 @@ The following permissions are required on the databases: ## Virtual Environment Recommendations -While physical machines are always preferred, Access Analyzer fully supports the use of virtual machines. This +While physical machines are always preferred, Access Analyzer fully supports virtual machines. This section contains special considerations for virtualized environments. -- VMWare® ESX® – If you use ESX, the following specifications are recommended: +- VMWare® ESX® – If you use ESX, Netwrix recommends the following specifications: - ESX 4.0 / ESXi™ 4.1 or higher - Virtual Hardware 7 or higher diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md index fe3eb42a95..a9e51262c2 100644 --- a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md +++ b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md @@ -6,20 +6,20 @@ sidebar_position: 10 # SharePoint Agent Permissions -When Access Analyzer SharePoint scans are run in agent-based mode, the Access Analyzer SharePoint -Agent must be installed on the SharePoint Application server which hosts the Central Administration -component before executing the scans. This is typically the first server stood up during the -SharePoint farm installation process in this mode. The data collection processing is conducted by -the SharePoint Agent for the target environment. The final step in data collection is to transfer +When you run Access Analyzer SharePoint scans in agent-based mode, you must install the Access +Analyzer SharePoint Agent on the SharePoint Application server that hosts the Central Administration +component before executing the scans. This is typically the first server deployed during the +SharePoint farm installation process in this mode. The SharePoint Agent conducts the data +collection processing for the target environment. The final step in data collection is to transfer the data collected in the SQLite databases, or Tier 2 databases, on the Access Analyzer SharePoint Agent server back to the Access Analyzer Console server. -The Access Analyzer SharePoint Agent needs to be installed on the: +Install the Access Analyzer SharePoint Agent on the: - SharePoint Application server hosting the Central Administration component - SharePoint® 2013 through SharePoint® 2019 - - Windows® Server 2016 through Windows® Server 2022 + - Windows® Server 2016 through Windows® Server 2025 **Additional Server Requirements** @@ -32,23 +32,23 @@ The following are additional requirements for the Access Analyzer SharePoint Age :::note The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the -server. The JDK deployed is prepackaged and doesn't require any configuration; it has been -preconfigured to work with Access Analyzer and should never be customized through Java. It will not -conflict with other JDKs or Java Runtimes in the same environment. +server. The JDK deployed is prepackaged and doesn't require any configuration. Netwrix +preconfigures it to work with Access Analyzer, and you shouldn't customize it through Java. It +doesn't conflict with other JDKs or Java Runtimes in the same environment. ::: If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread -requires a minimum of 2 additional GB of RAM per host. For example, if the job -is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16). +requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to +scan 8 hosts at a time, you need an extra 16 GB of RAM (8x2=16). ## Permissions Explained -If limited provisioning of the service account isn't required by the organization, then the +If the organization doesn't require limited provisioning of the service account, then the following permissions are sufficient for successful agent-based scans: -- Membership in the local Administrator group on the on server where the Access Analyzer SharePoint - Agent is installed +- Membership in the local Administrator group on the server where you install the Access Analyzer + SharePoint Agent - Only needed for agent installation @@ -79,8 +79,8 @@ following permissions are sufficient for successful agent-based scans: content and more - If the group doesn't exist already, then you need to create a new group at that level and grant it Read access. Specifically, it is a group that exists within Central - Administration at the farm administrator level. This group requires only Read access, not - farm admin access. After the group is created, add the service account that + Administration at the farm administrator level. This group requires only Read access and + doesn't grant farm admin access. After you create the group, add the service account that Access Analyzer uses to scan SharePoint. - Web Application permissions: @@ -103,7 +103,7 @@ following permissions are sufficient for successful agent-based scans: content databases, and give read access around sites, roles, and users - DB_Owner on Access Analyzer database if using Windows Authentication for the Storage Profile -- MySites permissions are based on the SharePointAccess Data Collector configuration option: +- MySites permissions depend on the SharePointAccess Data Collector configuration option: - Forcing the service account to become a temporary admin of the personal sites either as the service account or as a member of the Company Administrators group requires SharePoint Farm @@ -116,8 +116,8 @@ The following sections explain the less privilege and least privilege permission ## SharePoint Agent-Based Less Privilege Permission Model -If restricted permissions are desired by the organization, then the following permissions are needed -for the service account to successfully run SharePoint Agent-based scans. +If the organization requires restricted permissions, then the service account needs the following +permissions to successfully run SharePoint Agent-based scans. Before installing the SharePoint Agent, the service account to be supplied during installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing @@ -130,18 +130,18 @@ scans against the targeted SharePoint environment needs the following permission After the SharePoint Agent installation, this service account needs the following additional permissions to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing scans: -- Site Collection Administrator on all Site Collections to be scanned +- Site Collection Administrator on all Site Collections you plan to scan - Membership in the local Users group on the server where the SharePoint Agent is installed - DB_Owner on Access Analyzer database if using Windows Authentication for the Storage Profile -If the scans include Web Application scoping, then the following permissions are needed (can be -skipped if running full farm scans): +If the scans include Web Application scoping, then the service account needs the following +permissions (you can skip these when running full farm scans): - Membership in the local Backup Operators group - Membership in the local WSS_WPG group - WSS_CONTENT_APPLICATION_POOLS on the SharePoint Configuration database -After the Access Analyzer SharePoint Agent is installed, ensure that the service account has the +After you install the Access Analyzer SharePoint Agent, ensure that the service account has the following permissions: - Full Control on the agent install directory, default path is: @@ -155,14 +155,14 @@ with the following permissions to collect all of the data: - WSS_CONTENT_APPLICATION_POOLS on the SharePoint Configuration database :::note -If scans include Web Application scoping, this last permission requirement is already met. +If scans include Web Application scoping, you have already met this permission requirement. ::: ## SharePoint Agent-Based Least Privilege Permission Model -If a least privilege model is required by the organization, then the following permissions are -needed for the service account to successfully run SharePoint Agent-based scans. +If the organization requires a least privilege model, then the service account needs the following +permissions to successfully run SharePoint Agent-based scans. Before installing the SharePoint Agent, the service account to be supplied during installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing @@ -175,12 +175,12 @@ scans the targeted SharePoint environment needs the following permissions: After the SharePoint Agent installation, this service account needs the following additional permissions to run the Access Auditing (SPAA) scans: -- Site Collection Administrator on all Site Collections to be scanned +- Site Collection Administrator on all Site Collections you plan to scan - Membership in the local Users group on the server where the SharePoint Agent is installed - DB_Owner on Access Analyzer database if using Windows Authentication for the Storage Profile -If the scans include Web Application scoping, then the following permissions are needed (can be -skipped if running full farm scans): +If the scans include Web Application scoping, then the service account needs the following +permissions (you can skip these when running full farm scans): - READ Access on the following registry keys: @@ -202,7 +202,7 @@ skipped if running full farm scans): - `proc_getDependentObjectsByBaseClass` - `proc_ReturnWebFeatures` -After the Access Analyzer SharePoint Agent is installed, ensure that the service account has the +After you install the Access Analyzer SharePoint Agent, ensure that the service account has the following permissions: - Full Control on the agent install directory, default path is: @@ -222,8 +222,8 @@ with the following permissions to collect all of the data: - `proc_ReturnWebFeatures` :::note - These four stored procedures already have the correct permissions if Web Application - scoping is desired. + These four stored procedures already have the correct permissions if you want Web + Application scoping. ::: diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md b/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md index c7ba5bba47..758d207f77 100644 --- a/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md +++ b/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md @@ -12,7 +12,8 @@ security assessment for Microsoft SQL Server. **Supported Platforms** -- SQL Server 2022 +- SQL Server 2025 +- SQL Server 2022 - SQL Server 2019 - SQL Server 2017 - SQL Server 2016 @@ -39,10 +40,10 @@ conflict with other JDKs or Java Runtimes in the same environment. **Location** -The Microsoft SQL Server Solution is in the Jobs tree, as part of the Database Solution: Jobs > Database > SQL. +The Microsoft SQL Server Solution is in the Jobs tree, as part of the Database Solution: Jobs > Database > SQL. -The Database Solution license includes all supported database platforms supported by Access -Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for +The Database Solution license includes all database platforms that Access Analyzer +supports. Additionally, Sensitive Data Discovery enables the solution to search database content for sensitive data. ![Microsoft SQL Server Solution](/images/accessanalyzer/12.0/solutions/databases/sql/sqljobgroup.webp) @@ -50,22 +51,22 @@ sensitive data. The Microsoft SQL Server Solution includes: - Databases > 0.Collection > SQL > [0.Collection > SQL Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/collection/overview.md) – This job - group is designed to collect high level summary information from Microsoft SQL servers. This - information is used by other jobs in the SQL solution set for further analysis and for producing + group collects high level summary information from Microsoft SQL servers. Other jobs in the SQL + solution set use this information for further analysis and for producing respective reports. -- [1.Users and Roles Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/overview.md)– This job group is designed to provide +- [1.Users and Roles Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/overview.md)– This job group provides insight into user security, roles, and object permissions to all the SQL server objects -- [2.Activity Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/activity/overview.md) – This job group is designed to provide insight into +- [2.Activity Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/activity/overview.md) – This job group provides insight into use login activity, object permission changes, any unusual database activity, SQL activity against sensitive data, SQL activity against selective or all database objects -- [3.Permissions Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/overview.md) – This job group is designed to provide insight +- [3.Permissions Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/overview.md) – This job group provides insight into all types of permissions at the instance, database, and object level across all the targeted SQL servers -- [4.Configuration Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/overview.md) – This job group is designed to provide +- [4.Configuration Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/overview.md) – This job group provides insight into potential vulnerabilities related to SQL server configuration settings -- [5.Sensitive Data Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/overview.md)– This job group is designed to provide +- [5.Sensitive Data Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/overview.md)– This job group provides insight into where sensitive data exists and who has access to it across all the targeted SQL server databases -- [SQL_SecurityAssessment Job](/docs/accessanalyzer/12.0/solutions/databases/sql/sql_securityassessment.md) – This job is designed to summarize and - categorize the security findings into HIGH, MEDIUM, LOW, and NO FINDING categories based on their +- [SQL_SecurityAssessment Job](/docs/accessanalyzer/12.0/solutions/databases/sql/sql_securityassessment.md) – This job summarizes and + categorizes the security findings into HIGH, MEDIUM, LOW, and NO FINDING categories based on their severity. diff --git a/docs/accessinformationcenter/12.0/installation/overview.md b/docs/accessinformationcenter/12.0/installation/overview.md index 870351f128..c330e43cac 100644 --- a/docs/accessinformationcenter/12.0/installation/overview.md +++ b/docs/accessinformationcenter/12.0/installation/overview.md @@ -6,20 +6,20 @@ sidebar_position: 20 # Installation Overview -The Netwrix Access Information Center relies on collected and analyzed data that is stored in a -Microsoft® SQL® Server database. Netwrix Access Analyzer (formerly Enterprise Auditor) must be -installed, and there are specific solutions that are prerequisites for installing and using the +The Netwrix Access Information Center relies on collected and analyzed data stored in a +Microsoft® SQL® Server database. Netwrix Access Analyzer (formerly Enterprise Auditor) and +specific solutions are prerequisites for installing and using the Access Information Center. ## Prerequisites -The Access Information Center is typically installed on the same server as Access Analyzer. However, -it can be installed on a remote server. See the Remote AIC Console Sever Requirements topic for -additional information. +You typically install the Access Information Center on the same server as Access Analyzer. However, +you can install it on a remote server. See the Remote Access Information Center Console Server +Requirements topic for additional information. ### Access Analyzer Solutions -The .Active Directory Inventory Solution must be successfully executed before installing the +You must successfully execute the .Active Directory Inventory Solution before installing the Access Information Center. :::info @@ -31,23 +31,23 @@ supply the data for Resource Audits. ### Permissions Permissions are needed to the Access Analyzer database and to Active Directory. This can be one -account with sufficient rights to each or two separate accounts. In this document, -these will be referred to as the Database service account and the Active Directory service account. +account with sufficient rights to each or two separate accounts. This document refers to +these as the Database service account and the Active Directory service account. -- Database service account – Typically, this is the same account used by Access Analyzer for a - database service account. This credential is required for installation. +- Database service account – Typically, this is the same account that Access Analyzer uses for a + database service account. Installation requires this credential. - If you choose to use a different account, it must have the following permissions: - Database Owner - Provisioned to use Default Schema of ‘dbo’ - - Database connection via TLS 1.2 (SQL Native Client) is supported. + - The Access Information Center supports database connections via TLS 1.2 (SQL Native Client). - Active Directory service account – At a minimum, Access Information Center login authentication and Resource Audits require the Active Directory service account to have rights to read Active - Directory. This credential is configured during installation based on the account used for - connecting to the database. See the + Directory. You configure this credential during installation based on the account you use to + connect to the database. See the [Active Directory Page](/docs/accessinformationcenter/12.0/admin/configuration/activedirectory.md) topic for additional information. @@ -58,9 +58,9 @@ Active Directory. This is an optional component of change modeling, resource own and the Entitlement Reviews workflow. It is a requirement for the Self-Service Access Requests workflow. -In order for the Access Information Center to commit changes to Active Directory, Active Directory +For the Access Information Center to commit changes to Active Directory, the Active Directory service account must have additional rights on the OUs that house the security and distribution -groups to be managed: +groups you want to manage: - Allow Read Members - Allow Write Members @@ -71,18 +71,18 @@ additional information and best practices. ### SSL Certificate To enable Secure Sockets Layer (SSL) for secure remote connections to the Access Information Center, -a password-enabled certificate with a private key is required. This certificate should reside in a +you need a password-enabled certificate with a private key. This certificate should reside in a local folder for browsing before installing the Access Information Center. The certificate can also be in any of the Local Machine certificate stores. -### Remote AIC Console Sever Requirements +### Remote Access Information Center Console Server Requirements To install the Access Information Center on a server separate from the Access Analyzer Console, meet the following minimal server requirements for Access Reporting: -- Windows Server 2016 through Windows Server 2022 +- Windows Server 2016 through Windows Server 2025 - - US English language installation + - English (United States) language installation - Domain member - 2+ CPU Cores @@ -92,13 +92,13 @@ meet the following minimal server requirements for Access Reporting: :::note If using any of the Access Information Center workflows (Resource Reviews or -Self-Service Access Requests), additional CPU cores, memory, and disk space may be needed. +Self-Service Access Requests), you may need additional CPU cores, memory, and disk space. ::: ## Software Compatibility & Versions -For proper functionality, it is necessary for the version of the Access Information Center to be +For proper functionality, the version of the Access Information Center must be compatible with the existing Access Analyzer installation. If necessary, [Netwrix Support](https://www.netwrix.com/support.html) can confirm whether the two product versions are compatible.