diff --git a/docs/doxygen-user/images/grantAccessToComputer.PNG b/docs/doxygen-user/images/grantAccessToComputer.PNG new file mode 100644 index 0000000000..a155a20ea7 Binary files /dev/null and b/docs/doxygen-user/images/grantAccessToComputer.PNG differ diff --git a/docs/doxygen-user/images/objectTypesComputers.PNG b/docs/doxygen-user/images/objectTypesComputers.PNG new file mode 100644 index 0000000000..10b6db1444 Binary files /dev/null and b/docs/doxygen-user/images/objectTypesComputers.PNG differ diff --git a/docs/doxygen-user/images/sharedStoragePermissions.PNG b/docs/doxygen-user/images/sharedStoragePermissions.PNG new file mode 100644 index 0000000000..bea1aa0fd4 Binary files /dev/null and b/docs/doxygen-user/images/sharedStoragePermissions.PNG differ diff --git a/docs/doxygen-user/multi-user/installUsers.dox b/docs/doxygen-user/multi-user/installUsers.dox index 53a556ece8..d1e989a58f 100644 --- a/docs/doxygen-user/multi-user/installUsers.dox +++ b/docs/doxygen-user/multi-user/installUsers.dox @@ -20,7 +20,7 @@ The user account that Autopsy runs as will need access to the shared storage. Th - Domain Accounts: If the cluster is on a Windows domain, then Autopsy can be run with a domain account. - If your shared storage is a Windows file share, then users should be able to access it without needing a password. - If your shared storage is another platform, then you'll likely need to force Windows to store the shared storage credentials (as described below). -- Unique Local Unique Accounts: Some clusters are not on a Windows domain and have unique accounts for each analyst / user. +- Unique Local Accounts: Some clusters are not on a Windows domain and have unique accounts for each analyst / user. - If your shared storage is a Windows file share, then users will not need to enter their password IF the same user name and password exists on the file share server. - Otherwise, you'll need to force Windows to store the credentials. - Shared Local Account: Lastly, some clusters use a single local account, such as one named "autopsy" for all users. This is not recommended because Autopsy uses the login name to track who did certain actions, such as tagging files. @@ -32,13 +32,21 @@ The user account that Autopsy runs as will need access to the shared storage. Th Solr will run as a Windows service and will need access to the shared storage. The default user, which is "LocalService", will not have access to network-based storage. So, if you have network-based shared storage, you have three options: -- NetworkService: If you are on a domain, you maybe able to run Solr as the "NetworkService" account. This account has access to the network, but the challenge can be granting access for this account to the shared storage. - - If your shared storage is a Windows file share, you'll need to grant access to the computer running Solr. +- NetworkService: If you are on a domain, you may be able to run Solr as the "NetworkService" account. This account has access to the network, but the challenge can be granting access for this account to the shared storage. + - If your shared storage is a Windows file share, you'll need to grant access to the computer account running Solr as follows: +
  1. Right click on the shared storage folder choose "Properties" and select the "Security" tab. +
  2. Click the "Edit..." button and then click the "Add..." button. +
  3. Click on the "Object Types" button and confirm that the "Computers" object type has a check mark. + \image html objectTypesComputers.PNG +
  4. Enter the name of the computer and click the "Check Names" button to confirm that it is correct. + \image html grantAccessToComputer.PNG +
  5. Ensure that the computer account has both read and write access to shared storage. + \image html sharedStoragePermissions.PNG
- For other shared storage, you may not be able to access the data from the NetworkService account. -- Normal User: If you are not on a domain or cannot grant access to the computer for share storage, then run Solr as a normal user (local or domain). +- Normal User: If you are not on a domain or cannot grant access to the computer for shared storage, then run Solr as a normal user (local or domain). - If you do this, refer to the scenarios as outlined above for picking an Autopsy user. The same rules will apply with respect to passwords and saving credentials. - The main downside of this is that the service needs to be updated when the account password changes and it may require letting others know about the password. -- LocalService: Lastly, if you using the same server for both Solr and shared storage, then it is possible to run Solr as the default "LocalService" because it doesn't need network access. +- LocalService: Lastly, if you are using the same server for both Solr and shared storage, then it is possible to run Solr as the default "LocalService" because it doesn't need network access.