Stored Data Integration Guide › Deploying the FSA › Specify FSA User Accounts › FSA Run As User

FSA Run As User

The FSA Run As user is the user account that FSA scanning jobs run as. This guide identifies two types of Run As user, reflecting their different purposes:

• Limited Access FSA Run As User: You can use the FSA to test whether sensitive documents stored on your network are accessible to unauthorized users. To do this, you set up a scanning job to run as a user with limited access to sensitive network locations. This is your ‘limited access FSA Run As user’.

  This ‘limited access’ user is representative of your ordinary network users. If, while running as this user, the FSA detects and scans documents that should not be accessible to ordinary users, this indicates that your network security needs to be tightened.

• Full Access FSA Run As User: You can use the FSA to scan the content of files stored on your network to determine if sensitive information is stored in the correct location or to identify files or documents with unauthorized content. (Indeed, this is often regarded as the ‘classic’ use for the FSA.)

  To do this, the FSA must be able to access remote file systems and delete files when instructed to do so as a result of policy processing. Specifically, the FSA must run as a domain user with permission to delete and copy files on any machines that you want to scan. This user is your ‘full access FSA Run As user’. See the account requirements below.

In both cases, we recommend that the FSA Run As user is a custom account created for exclusive use by the FSA. This is because it is essential that nobody logs in to a scanned machine using the ‘Run As’ account while a scheduled scan is running!

You typically specify an FSA Run As user when you schedule a scanning job using the Job Definition wizard in the Administration console (see step 3 of Schedule a scanning job) or when you log in to Windows before running a scanning job from a command line.