FSA Archiving Question

[ia01]

Hi,

Just want to check if FSA can archive a folder is EV Service account doesn't have explicit access permission on files and fodler level? 

Service account is local administrator though. But some fodlers has unique permissions and EVSVC doesn't have access to those folder.

As far as I understand FSA should be able to archive those folder, can anyone please confirm?

Many Thanks

[JesusWept3]

It can't archive anything it specifically doesn't have permissions to, because it simply cannot access the file So if you found a file in one of those directories and go to the security tab and do effective permissions, if it shows as not having access it can't archive the item or turn it into a shortcut

[GabeV · Accepted solution]

Hi ia01,

I just did a test in my 10.0. 3 lab and explicit denied permissions to the VSA in a new folder called NoAccess:

However, after running the FSA archiving task, the report shows that all the files inside that folder were archived:

Archive mode run started at 11/15/2013 10:37:35 AM for task File System Archiving Task

Task run: 1
Time    File    Size (bytes)    Policy name    Rule name    Rule type    Archive status    Shortcut type    Shortcut status    Filter Modifications
--------------------------------------------------------------------------------------------------------------------------------------------------
11/15/2013 10:38:03 AM    \\FSA.evlab.local\Disk_D\NoAccess\dt_ph001.log    18722    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 10:38:03 AM    \\FSA.evlab.local\Disk_D\NoAccess\dt_phs01.log    17677    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 10:38:03 AM    \\FSA.evlab.local\Disk_D\NoAccess\dt_phs02.log    9606    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 10:38:03 AM    \\FSA.evlab.local\Disk_D\NoAccess\dt_phs03.log    17961    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 10:38:03 AM    \\FSA.evlab.local\Disk_D\NoAccess\dt_phs04.log    35041    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 10:38:03 AM    \\FSA.evlab.local\Disk_D\NoAccess\dt_phs05.log    221622    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    

Also, I checked the folder with the local Administrator user (since VSA has no access) and all the files were replaced by placeholders. So, it appears that even though the VSA has no access to the folder, the PH service can still archive the content.

I'll do another test where Admins have no permissions and will update the post.

** Update **

Did another test where only a user had access to the folder and the content was archived:

Archive mode run started at 11/15/2013 11:46:47 AM for task File System Archiving Task

Task run: 1
Time    File    Size (bytes)    Policy name    Rule name    Rule type    Archive status    Shortcut type    Shortcut status    Filter Modifications
--------------------------------------------------------------------------------------------------------------------------------------------------
11/15/2013 11:46:53 AM    \\FSA.evlab.local\Disk_D\NoAccessAdmin\dt_ph001.log    18722    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 11:46:53 AM    \\FSA.evlab.local\Disk_D\NoAccessAdmin\dt_phs01.log    17677    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 11:46:53 AM    \\FSA.evlab.local\Disk_D\NoAccessAdmin\dt_phs02.log    9606    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 11:46:53 AM    \\FSA.evlab.local\Disk_D\NoAccessAdmin\dt_phs03.log    17961    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 11:46:53 AM    \\FSA.evlab.local\Disk_D\NoAccessAdmin\dt_phs04.log    35041    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated    
11/15/2013 11:46:53 AM    \\FSA.evlab.local\Disk_D\NoAccessAdmin\dt_phs05.log    221622    Default FSA Volume Policy    All    ARCHIVE    Archived    CREATESHORTCUTSIMMEDIATELY    ShortcutCreated   

I hope this helps.

[Darren_Locke · Accepted solution]

If the VSA is a member of local administrators, then you do not need explicit permissions on the files or folders. The system level permissions it will be granted are enough for archivnig to happen. From 10.0.3 we eliminated the need to be a local admin, and the VSA can run as a Backup Admin (if memory serves me right). The permissons needed are documented in the FSA admin guide.

Darren