What is a one sentence summary of your feature request?
Need the ability to install Only desired product features
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
A Customer only wants Auditor to provide NTFS permissions to Data Collection reports. Auditor requires a lot of superfluous security permissions in order for the product to work at all. NTFS permission collections do not require access to Event Logs or Registry keys. The product should allow the customers to install only the features they want to use, in order to prevent overreaching security settings that weaken the security of the customers environment.
How do you currently solve the challenges you have by not having this feature?
We have no solution because we were told Auditor requires these unnecessary security settings to function. This is not why we purchased the Auditor product. We only wanted the Report, of the files that were flagged by Data collection, to include a list of the NTFS settings for that file. This would inform us what accounts were able to access the file that may contain PII or other sensitive data. The unnecessary requirements for Auditor are unsettling to this new customer.
Thank you very much for your request. I understand what you’re asking for, and you’re right that collecting NTFS permissions doesn’t require any other access.
As far as I remember, you can already get this behavior without a separate installation option. In the monitoring plan for the file servers, turn off all the settings related to Changes (activity auditing) and Auto audit. Only the state-in-time data collection.
According to what Support and the Implementation team is informing me, Auditor requires permissions be configured for things that are not being used. For example, when only needing NTFS permissions to be collected, the Auditor software still requires Domain Admin access to File Share Servers, Event Logs, and Registry keys. None of which are needed when querying NTFS permission.
The ability to disable the features that require Domain Admin access to File Share Servers, Event Logs, and Registry keys would be a valuable feature for your company. I am discussing the possibility of getting rid of Auditor since it does not perform the task we needed it to, without risking our network security to implement. We paid for something that is causing unnecessary risk to our security posture, to perform a task that does not require the level of permissions being required.
