Enterprise Vault™ Setting up File System Archiving (FSA)
- About this guide
- About File System Archiving
- About FSA shortcut files
- Steps to configure File System Archiving
- Adding a Windows file server to File System Archiving
- About archiving from Windows Server 2012 or later file servers
- Permissions and privileges required by the Vault Service account on Windows file servers
- Adding a NetApp filer to File System Archiving
- Adding a NetApp C-Mode Vserver to File System Archiving
- Adding a Celerra/VNX device to File System Archiving
- Adding a Dell EMC Unity device to File System Archiving
- Configuring FSA with clustered file servers
- Troubleshooting the configuration of FSA with clustered file servers
- Installing the FSA Agent
- Defining volume and folder policies
- About selecting the shortcut type for an FSA policy
- About FSA policy archiving rules
- Configuring the deletion of archived files on placeholder deletion
- Configuring target volumes, target folders, and archive points
- About adding target volumes, target folders, and archive points for FSA
- About managing archive points
- Archive point properties
- Effects of modifying, moving, or deleting folders
- About deleting target folders, volumes, and file servers
- Configuring pass-through recall for placeholder shortcuts
- Configuring and managing retention folders
- Configuring and running FSA tasks
- Using Run Now to process FSA targets manually
- Configuring file system filtering
- Managing the file servers
- PowerShell cmdlets for File System Archiving
- Appendix A. Permissions and privileges required for the Vault Service account on Windows file servers
- Permissions required by the Vault Service account for the FSA Agent
About options for archiving files that have explicit permissions, and files under DAC
FSA volume policies and folder policies let you specify whether to archive the following:
Files that have explicit permissions. That is, files with permissions applied directly to them. Note that when evaluating a file for explicit permissions, Enterprise Vault ignores Dynamic Access Control (DAC) permissions.
Files that are under DAC. That is, files whose access is controlled completely or partially through a DAC central access policy, user claim, or device claim.
The default policy setting is not to archive these files.
Before you choose to archive files that have explicit permissions or files that are under Dynamic Access Control, note the following:
In the archive no explicit file permissions apply, and no DAC permissions apply. The result is that an archived file has the permissions of its parent folder, less any DAC permissions.
If Enterprise Vault leaves a placeholder shortcut, the placeholder has all the permissions of the original file.
The absence of explicit file permissions and all DAC permissions in the archive has the following consequences:
A user who has conventional (non-DAC) permission to access a folder can find and access any file in the associated archive folder. However, if the user did not have permission to access the original file, the user cannot access the archived file from its placeholder.
A user who has conventional (non-DAC) permission to delete items from a folder can delete the archived version of any file from the associated archive folder. However, if the user did not have permission to delete the original file, the user cannot delete its placeholder.
A user who has access to a file through DAC alone cannot access the file in the archive.
Note that to allow access to files in the archive, you can set permissions manually on an archive from the Enterprise Vault Administration Console. If you set permissions on an archive they are applied to every folder in the archive.
If a file is restored from the archive, the restored file has the original parent folder permissions, less any DAC-related permissions that were applied directly to the file.
If a file is recalled from a placeholder, the placeholder's permissions are retained in the recalled file. The recalled file has all the permissions of the original file, unless the permissions of placeholder or the inherited permissions of any of its parent folders were changed.