Overview
Once you enable Privilege Analysis and a scan completes on your SMB file servers, DSPM fetches user and group metadata from Active Directory via LDAP to compute effective access and surface data governance risks.
Results appear across three main areas: the Data Store Inventory page, the Data Store Users page, and the Classification Management (Files tab).
Important Technical Constraints:
- DSPM resolves nested group memberships up to 5 levels deep and traverses folder hierarchies up to 20 levels deep.
- Privilege Analysis is supported only via the modern SMB connector (SMB v2/v3). CIFS (SMB v1) is not supported.
- DSPM does not support native remediation for SMB file shares. You must manually remediate risks within the SMB file share itself (see Recommended Actions below).
- For large-scale environments, contact your Netskope DSPM team before enabling Privilege Analysis to ensure your backend is properly scaled for your volume of files and users.
For setup instructions, see Connect SMB File Share to DSPM.
Data Store Inventory — Sensitive Data Risk
After a successful scan, the Data Store Inventory page displays the following Sensitive Data Risk indicators for SMB shares:
- Sensitive files with org-wide access: Count of sensitive files accessible to Global Access Groups such as “Everyone,” “Authenticated Users,” or “Domain Users.” Click this count to navigate to Classification Management with the Exposure filter set to “Internal All.”
- Sensitive files with broken inheritance: Count of sensitive files where permission inheritance has been disabled, resulting in explicit permissions that differ from the parent folder. This flags “hidden” exposure where a subfolder in a secure tree was accidentally opened up. Click this count to navigate to Classification Management with the Broken Inheritance filter applied.
- Data Risk score: A computed score that contributes to the overall Data Store Risk rating, based on the exposure and inheritance metrics above.
Data Store Inventory — Privilege Analysis (Risky Access to Data)
This section displays the following identity-related risk metrics:
- Over-Privileged Data Store Risk: A computed risk rating based on stale and disabled users with access to sensitive data.
- Stale users: Count of users with access to sensitive data whose
lastLogonTimestampindicates inactivity for more than 90 days or who have never logged in. - Unresolved SIDs (ghost users): Count of Security Identifiers (SIDs) on file ACLs that no longer resolve to a user or group in Active Directory (indicating deleted accounts that retain access permissions).
- Users/Groups with access to sensitive data: Count of distinct identities or groups with effective access to sensitive files.
- Total users: Total distinct identities with access to the share.
Data Store Users Page
Click any user or group count in the Data Store Inventory to navigate to this page. You can filter the page by various parameters (Username, Employee Name, Exposure, etc.).
When an Identity Provider like Okta or Entra ID is integrated, DSPM maps SMB Active Directory users to their IDP employee records, displaying employee name, department, and status alongside their SMB access data
| Column | Description |
|---|---|
| User/Group | Username, group name, or raw SID (for ghost users). |
| Employee Name | Full name from the IDP, if mapped. Blank if no IDP integration. |
| Department | Department from the IDP, if mapped. |
| Status | Active, Disabled, or Stale, based on AD and IDP data. |
| Sensitive Files | Count of sensitive files this user or group can access. |
| Accessible Sensitive Data Types | DLP profiles accessible to this identity (e.g., PII, PCI, PHI). |
| Group Membership | Up to 5 levels of nested parent groups for the user (blank for groups). |
| Risk Indicators | Visual flags for org-wide access groups, ghost users (unresolved SIDs), and stale users. |
| User Risk Rating | Calculated score based on the user’s risk indicators. |
Classification Management — Files Tab (SMB View)
Click any sensitive file count in the Data Store Inventory to navigate to the Files tab. For SMB data stores, this view displays the following additional columns:
| Column | Description |
|---|---|
| Exposure | Effective exposure level of the file: Internal All (org-wide access), Internal (shared with specific internal users), or Private (only the file owner). |
| Users with Access | Count of distinct users with effective access to this file (the file’s “blast radius”). |
| Permission Source | How each user accesses the file: Direct (User), Direct (Group), Inherited (User), or Inherited (Group). This helps you identify exactly which ACL or parent folder to modify for remediation. |
| Effective Permission Level | The user’s effective permission: Read vs. Modify/Delete. |
| Broken Inheritance | Flag indicating whether this file has broken inheritance (applicable only to SMB). |
DSPM Dashboard — SMB Privilege Analysis Risk Rules
DSPM surfaces the following built-in risk rules on the Dashboard. These rules update automatically based on the configured scan schedule.
1. Sensitive files are accessible to Global Access Groups
- Severity: Critical
- Category: Data
- Description: Files containing sensitive data are accessible to the entire organization through Global Access Groups (e.g., “Everyone,” “Domain Users”), either directly on the file or inherited. This violates the principle of least privilege.
- Recommended Actions: On Windows, navigate to the file/folder > Properties > Security tab. If the permission is Direct, select the global group and click Remove. If Inherited, navigate to the parent folder to remove the group from the hierarchy.
2. Sensitive files have broken inheritance
- Severity: High
- Category: Data
- Description: Files containing sensitive data have disabled permission inheritance, resulting in explicit permissions that differ from the parent folder. The file may be inadvertently exposed.
- Recommended Actions: On Windows, navigate to the file > Properties > Security tab > Advanced. Click Enable Inheritance to restore alignment with the parent folder.
3. Ghost users access sensitive data due to unresolved SIDs
- Severity: Medium
- Category: Access / Hygiene
- Description: File ACLs contain Unresolved SIDs granted to user/group IDs that no longer exist in Active Directory. These orphaned entries create “permission debt”.
- Recommended Actions: On Windows, navigate to the file > Properties > Security tab. Look for entries labeled “Unknown Account” followed by a long alphanumeric string. Select and click Remove. For bulk cleanup, consider using a PowerShell script.
4. Risky Users with access to Sensitive files
- Severity: Critical
- Category: Access
- Description: Users with a High or Critical User Risk Rating have effective permissions to access files containing sensitive data, representing an immediate path for data exfiltration.
- Recommended Actions: Revoke the risky user’s file access. If the risk indicates a compromised account, disable the account in Active Directory or suspend the user in your IDP (Okta/Entra ID).
5. Stale or disabled users can access sensitive files
Recommended Actions: Remove the stale/disabled user from the file’s ACL or remove the user from the AD group granting access. For stale accounts still enabled, disable them in AD and move them to a “Disabled Users” OU.
Severity: High
Category: Access
Description: Active permissions on sensitive files are held by accounts that are Disabled in Active Directory or flagged as Stale (inactive for >90 days).