Scan & Encrypt

The Scan & Encrypt functionality locates and encrypts files containing sensitive data on file servers and SharePoint. Agents scan selected file servers and SharePoint sites for files containing sensitive data. Based on the selected scan action, matching files are encrypted or decrypted.

Scan & Encrypt consists of the following sections:

Section	Description
Target Discovery	Identify file servers and SharePoint sites available for scanning.
Devices/Services Found	View and manage file servers and SharePoint sites identified through discovery jobs.
Scans	Create one-time or ongoing scan jobs for selected file servers and SharePoint sites.
Results	Review the list of files encrypted or decrypted in completed scans.
Agent Devices	Monitor and manage Agent Devices registered to your environment.

Target Discovery

Target Discovery identifies the file shares and SharePoint sites available for scanning in your environment. Before running scans, targets must be discovered. Once a discovery job completes, the discovered file servers and SharePoint sites appear under PROTECT > Repository Files > Devices/Services Found.

Discover File Shares to Scan

Create a new target discovery job for Devices to find file shares within a specified IP range.

1. Navigate to PROTECT > Repository Files > Target Discovery.
2. Click Devices and select +New Target Discovery.

   
3. In the Discovery Job Name field, enter a descriptive name that identifies the purpose of the job (e.g., Finance Department Workstations, Sydney Office Network Scan).
4. In the Target IP Range field, enter the IP address range where DISCOVER should search for devices (e.g., 192.168.1.100 ).
5. Select the Location filter to narrow the list of available Agents by their assigned location.
6. Select the Agent you want to use.
7. Select the Authentication method:

   1. Username + Password: Select this option to authenticate using SMB credentials. Enter the Username, Password, and SMB Location.
   2. Certificate + Password: Select this option to authenticate using a certificate. Upload the certificate file and enter the associated password.
8. Set the Connection Retry Frequency to define how often the system will attempt to reconnect if the initial connection fails. Shorter intervals result in faster retries but increased network traffic; longer intervals reduce network load but slow down discovery.
9. Set the Connection Timeout After to define how long the system will continue attempting to establish a connection before marking the target as unreachable.
10. Click Save.

GuardWare begins connecting to File shares within the specified IP range. The discovery job appears in the Target Discovery list.

Discover Services to Scan

Create a new target discovery job for Services to connect to SharePoint Online.

1. Navigate to PROTECT > Repository Files > Target Discovery.
2. Click Services and select +New Target Discovery.

   
3. Enter a descriptive Discovery Job name.
4. Provide your SharePoint organisation name, Tenant ID, and Client ID.

   1. SharePoint Organisation: The first part of your SharePoint URL (e.g., if your URL is https://organisation.sharepoint.com, enter organisation).
   2. SharePoint Tenant ID: Same as Exchange Tenant ID.
   3. SharePoint Client ID: The Application (Client) ID of your registered SharePoint application in Azure AD.
5. Select the Location to filter the list of Agents by their assigned location.
6. Select the Agent you want to use.
7. Set the Connection Retry Frequency to define how often GuardWare will attempt to reconnect if the initial connection fails. Shorter intervals result in faster retries but increased network traffic; longer intervals reduce network load but slow down discovery.
8. Set the Connection Timeout After to define how long GuardWare will continue attempting to connect before marking the target as unreachable.
9. Click Save.

   

Devices/Services Found

Devices/Services Found lists all file servers and SharePoint sites identified through completed discovery jobs. This is also where you reassign a discovered location to a different Agent Device. Each entry shows the hostname, assigned Agent Device, category, last activity, and current status.

Reassign Agent

1. Navigate to PROTECT > Repository Files > Devices/Services Found.
2. Select one or more file servers or SharePoint sites and click +Reassign Agent.
3. Select the new Agent device from the list and click Save.

   
4. In the pop-up window, click Assign.

Scans

Agents scan selected file servers and SharePoint sites for files containing sensitive data. Two scan types are available:

• One-Time Scan, which runs a single, non-recurring scan on selected devices and services.
• Ongoing Scan, which runs a recurring scan on selected devices and services.

If you are running Scan & Encrypt for the first time, start with a one-time scan on a single file server or SharePoint site. This lets you confirm the configured data types and scan action before you set up an ongoing scan.

One-Time Scan

Use a one-time scan to validate the configuration on a limited scope first. The agent checks files and, if sensitive data is present, encrypts or decrypts them based on the selected scan action.

1. Navigate to PROTECT > Repository Files > Scans and click +New Scan.

   
2. Select One-Time Scan and click Proceed.

   
3. Enter a Scan Name that clearly identifies the purpose of the scan (e.g., Finance SharePoint - Credit Card Check).
4. Add an optional Description for context and click Next.
5. Select the Data Types you want to scan and click Next.

   
6. Select the devices and/or SharePoint sites to scan, then click Next.

   
7. Select a Scan Action if encryption or decryption is required, then click Next.
8. Filter Directories and File Types: This setting allows you to include or exclude specific folders and file types from the scan. You have multiple options for controlling which folders and file types are scanned:

   If you skip this configuration, GuardWare will scan all folders and file types in every selected target for sensitive data.

   1. Scan only the selected folders and file types: Limit the scan to specific locations and file formats. Only what you explicitly select is scanned. Use this when you already know where sensitive data is likely to exist and want to focus the scan there instead of scanning everything.

      • Enter custom folder path: Click +Add to include folders to scan. Enter the full path (e.g., C:\Users\Public\Documents, \\fileserver\HR\Payroll). Add multiple paths as needed. Only these folders are scanned.
      • Include all file types: Enable Include all file types to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only.
      • Include custom file extension: Click +Add to specify extensions for uncommon or proprietary file extensions not in GuardWare's file type list. Only files having these extensions will be scanned.

      
   2. Scan all content except the selected folders or file types: Use this when you want broad coverage while skipping known irrelevant areas, such as system folders, logs, or temporary folders.

      • Enter custom folder path: Click +Add to specify folders to exclude. Enter the full path (e.g., C:\Windows\Temp, \\fileserver\Backups, D:\Logs). These folders are skipped during the scan.
      • Exclude all file types: Enable Exclude all file types to skip file content scanning entirely and examine only file metadata, such as filenames and paths. This is rarely used and typically needed only for filename-based data types.
      • Enter custom file extension: Click +Add to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., .backup, .cache).

      
9. Click Next.
10. Review the scan configuration summary and click Save. The scan starts automatically and appears in the Scans list with the progress and status indicators.

Ongoing Scan

Use an ongoing scan after you have validated the configuration with a one-time scan. This is the right option when the same file server or SharePoint site needs recurring coverage.

1. Navigate to PROTECT > Repository Files > Scans and click +New Scan.
2. Select Ongoing Scan and click Proceed.

   
3. Select the Data Types you want to scan and click Next.

   
4. Select the file servers and/or SharePoint sites to scan, then click Next.

   
5. Select a Scan Action if encryption or decryption is required, then click Next.

   
6. Filter Directories and File Types: This setting allows you to include or exclude specific folders and file types from the scan. You have multiple options for controlling which folders and file types are scanned:

   If you skip this configuration, GuardWare will scan all folders and file types in every selected target for sensitive data.

   1. Scan only the selected folders and file types: Limit the scan to specific locations and file formats. Only what you explicitly select is scanned. Use this when you already know where sensitive data is likely to exist and want to focus the scan there instead of scanning everything.

      • Enter custom folder path: Click +Add to include folders to scan. Enter the full path (e.g., C:\Users\Public\Documents, \\fileserver\HR\Payroll). Add multiple paths as needed. Only these folders are scanned.
      • Include all file types: Enable Include all file types to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only.
      • Include custom file extension: Click +Add to specify extensions to scan uncommon or proprietary file extensions not in GuardWare's file type list. Only files having these extensions will be scanned.

      
   2. Scan all content except the selected folders or file types: Use this when you want broad coverage while skipping known irrelevant areas, such as system folders, logs, or temporary folders.

      • Enter custom folder path: Click +Add to specify folders to exclude. Enter the full path (e.g., C:\Windows\Temp, \\fileserver\Backups, D:\Logs). These folders are skipped during the scan.
      • Exclude all file types: Enable Exclude all file types to skip file content scanning entirely and examine only file metadata, such as filenames and paths. This is rarely used and typically needed only for filename-based data types.
      • Enter custom file extension: Click +Add to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., .backup, .cache).

        
7. Set a schedule to define when and how often the scan runs.

   1. In REPEAT FREQUENCY, enter how frequently the scan should run.

      1. Select an interval: Choose how often the scan repeats.
      2. Select a time: Choose when the scans start. Example: Selecting 2 Months at 6:00 PM repeats the ongoing scan every 2 months at 6:00 PM.

         
   2. Choose the Scan Start date:

      1. On Date: Select a calendar date when the first scan should run. The scan will start on this date and then repeat according to the interval you set.
      2. Relative: Select a specific period and day (Monday, Tuesday, etc.) when scans should run. This is useful for scheduling scans during low-activity periods (e.g., 1st Sunday).

         
   3. Ongoing scans can be resource-intensive (high CPU usage, network traffic, disk I/O); it's best to schedule them during off-hours when they won't impact user productivity. Use the Avoid Scans Window setting to define periods during which scheduled scans must not run, even if they are due to start.

      1. Click +Add avoid window to add a restriction.
      2. Select the day(s) of the week when scans should be avoided. Select the time range to avoid (e.g., 8:00 AM to 6:00 PM for business hours). You can add multiple avoid time windows to accommodate different schedules.

         
   4. Beside the schedule, you'll find the Terminate Current Scan option.

      1. Enable Terminate Current Scan to stop any scan that is currently running when the newly configured ongoing scan starts.
      2. Leave Terminate Current Scan disabled if you want the current scan to finish first.

         

   Note when Terminate Current Scan is disabled:

   If the current scan runs past the scheduled start time of the new scan, the new scan will not run for that occurrence. It will wait until the next scheduled slot, whether that is the following week or month. This can create a gap in scheduled coverage, so keep this in mind when setting scan times.
8. Click Next.
9. Review the details and click Save to initiate the scan. The scan starts automatically and appears in the Scans list with a status indicator. The schedule runs automatically until the scan is disabled or deleted.

Scan Action

Scan Action defines what happens when the agent identifies a file containing sensitive data. The selected action is carried out by GuardWare PROTECT.

Scan Action	Description
Encrypt on Scan	Files containing sensitive data are copied to the Agent Device, analysed, and if sensitive data is confirmed, encrypted and copied back to their original location. Encryption is based on the security group assigned to the matching data type in Encrypt by Data Type. Only one scan action can be selected per scan.
Decrypt on Scan	Encrypted files containing sensitive data are copied to the Agent Device, analysed, and if confirmed, decrypted and copied back to their original location. Decryption is based on the security group assigned to the matching data type in Encrypt by Data Type.

For Scan Action to function correctly, the following must be configured beforehand:

• In PROTECT > Protection Scope > Active Data Types, each relevant Data Type must be defined, enabled, and have a Security Group assigned.
• In SECURITY GROUPS, a Security Group must be created with the relevant users added.
• For Microsoft Office files, configure the applicable PROTECT settings in PROTECT > Classification Settings.

Results

All files encrypted or decrypted in completed scans are listed on the Results page, organised by target type, either file servers or SharePoint. Use the filter controls at the top of the page to narrow results by scan job, target, or data type.

Each record shows the file location, matched data types, sensitivity classification, number of matches, and the current file status, including whether it has been encrypted or decrypted.

Agent Devices

Agent Devices show the Windows services installed across your environment that run discovery and scan jobs.

Each entry shows the Agent Device's name, assigned location, online status, last seen timestamp, and installed version. If an Agent Device appears as offline or unreachable, verify that the host device is powered on, connected to the network, and that the Agent is running.