Updates to picking users documentation.

This commit is contained in:
esaunders 2019-07-15 15:12:55 -04:00
parent 4d0f8bbb4f
commit 63b0229123
4 changed files with 13 additions and 5 deletions

Binary file not shown.

After

Width:  |  Height:  |  Size: 5.1 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 7.3 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 9.0 KiB

View File

@ -20,7 +20,7 @@ The user account that Autopsy runs as will need access to the shared storage. Th
- <b>Domain Accounts</b>: If the cluster is on a Windows domain, then Autopsy can be run with a domain account.
- If your shared storage is a Windows file share, then users should be able to access it without needing a password.
- If your shared storage is another platform, then you'll likely need to force Windows to store the shared storage credentials (as described below).
- <b>Unique Local Unique Accounts</b>: Some clusters are not on a Windows domain and have unique accounts for each analyst / user.
- <b>Unique Local Accounts</b>: Some clusters are not on a Windows domain and have unique accounts for each analyst / user.
- If your shared storage is a Windows file share, then users will not need to enter their password IF the same user name and password exists on the file share server.
- Otherwise, you'll need to force Windows to store the credentials.
- <b>Shared Local Account</b>: Lastly, some clusters use a single local account, such as one named "autopsy" for all users. This is not recommended because Autopsy uses the login name to track who did certain actions, such as tagging files.
@ -33,12 +33,20 @@ Solr will run as a Windows service and will need access to the shared storage.
So, if you have network-based shared storage, you have three options:
- <b>NetworkService</b>: If you are on a domain, you may be able to run Solr as the "NetworkService" account. This account has access to the network, but the challenge can be granting access for this account to the shared storage.
- If your shared storage is a Windows file share, you'll need to grant access to the computer running Solr.
- If your shared storage is a Windows file share, you'll need to grant access to the computer account running Solr as follows:
<ol> <li> Right click on the shared storage folder choose "Properties" and select the "Security" tab.
<li> Click the "Edit..." button and then click the "Add..." button.
<li> Click on the "Object Types" button and confirm that the "Computers" object type has a check mark.
\image html objectTypesComputers.PNG
<li> Enter the name of the computer and click the "Check Names" button to confirm that it is correct.
\image html grantAccessToComputer.PNG
<li> Ensure that the computer account has both read and write access to shared storage.
\image html sharedStoragePermissions.PNG </ol>
- For other shared storage, you may not be able to access the data from the NetworkService account.
- <b>Normal User</b>: If you are not on a domain or cannot grant access to the computer for share storage, then run Solr as a normal user (local or domain).
- <b>Normal User</b>: If you are not on a domain or cannot grant access to the computer for shared storage, then run Solr as a normal user (local or domain).
- If you do this, refer to the scenarios as outlined above for picking an Autopsy user. The same rules will apply with respect to passwords and saving credentials.
- The main downside of this is that the service needs to be updated when the account password changes and it may require letting others know about the password.
- <b>LocalService</b>: Lastly, if you using the same server for both Solr and shared storage, then it is possible to run Solr as the default "LocalService" because it doesn't need network access.
- <b>LocalService</b>: Lastly, if you are using the same server for both Solr and shared storage, then it is possible to run Solr as the default "LocalService" because it doesn't need network access.