Security Compliance

DFS Replication deletes id.8MAN files in ARM

The DFS Replication deletes .id.8MAN files. When using DFS Replication and ARM, scanning both the source server and the destination server cause permissions to be lost.

First published date

8/29/2019 4:54 PM

Last published date

8/29/2019 4:54 PM

Overview

This article details an issue in which the DFS Replication deletes .id.8MAN files. When using DFS Replication and ARM, scanning both the source server and the destination server cause permissions to be lost.

Product section

Access Rights Manager

Cause

  • ARM deletes the.id.8MAN files used to map the permission group to the directory.
  • The .id.8MAN files are replicated and ARM scans both the source and the target server. 
  • ARM detects that the replicated object, the .id.8MAN file, is also in the target by mistake and deletes that file from the directory. 
    • ARM automatically deletes the .id.8MAN files when, for example, a directory is moved.
    • With changed authorizations on this directory, the authorization groups intended for a completely different directory, are used for this directory.
  • The directory is back-replicated to the source server and to the source server.
    • The server deletes the .id.8MAN file.
    • ARM loses the assignment of the permission groups to the directories, and users lose their permissions.

Resolution

  • Only scan an original shared source with ARM and assign the permissions there. The replicated share source - the target - cannot be scanned.
    • Keeps the .id.8MAN files in the synced folder.
    • Since ARM does not scan this directory, it does not erase the .id.8MAN files.
    • Ensures that ARM does not lose the assignment of the permission group to the directory.
  • For greater security, exclude .id.8MAN files from DFS replication.
  • Also possible to scan only the DFS and assign the permissions there, as long as all folders are included in the DFS that you want to scan with ARM.