0

We currently operate about four file servers, all running Windows Server 2008 R2.

Until now, we have used the Windows internal file search (aka “Indexing options”) and this worked OK and found all files without problems. Now a new universal search is rolled out, which means all file servers will be remotely scanned by the crawler using the user DaCrawler. No local crawler will be installed on the file server.

The crawler connects with a given user to our file server and needs read-only access to all files and folders for the shares we have created. However, there are about 350k folders with 2,7M files just on our main server and a lot of custom DACLs are in place. Especially, there is no root DACL in place that applies to all folders or files.

The only idea I have to so far is to give the DaCrawler read-only access by using SetACL and add it to each any every DACL that might exist (I ignore ICACLS because I think SetACL is easier to use).

First, I set the DACL of all folders to include READ_EX permissions for DaCrawler

SetACL -on C:\Test -ot file -actn ace -ace "n:ACME\DaCrawler;p:read_ex;i:so,sc;m:grant" -rec cont

This works fine, and no explicit permissions are created if they are not necessary:

Folder permission screen shot

If there are files with explicit permissions, their DACL is not changed so I repeat the command, this time for files only:

SetACL -on C:\Test -ot file -actn ace -ace "n:ACME\DaCrawler;p:read_ex;i:so,sc;m:grant" -rec obj

However, this causes SetACL to create explicit permissions for each and every file even if the file did not have a explicit permission before and the folder permission would be enough:

screenshot of permissions

This means, I can either decide to apply the changes only to folders which might make some files inaccessible to the crawler, or create 2,7M explicit permissions.

Is there are better way to do this? Is my approach with changing the DACLs wrong and a more efficient way exist?

Improve this question

1 Answer 1

Reset to default
2

Your solution of setting explicit permissions will work - for about a week until someone creates a new file with explicit permissions.

Have you considered adding your crawler account to the domain backup operators group? that should get it read access to any file on a domain file server.

Improve this answer
1
  • Thank you! I would have set these commands as scheduled tasks anyway, so this would only be a problem for 24 hours or less. However, your solution with the Backup Operators group sounds like the best solution possible. Let me make some tests if this works for us.
    – Tex Hex
    Oct 25, 2012 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .