> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/documentation/protect/scan-and-encrypt/scan-and-encrypt.md). # Scan & Encrypt The Scan & Encrypt functionality locates and encrypts files containing sensitive data on file servers and SharePoint. Agents scan selected file servers and SharePoint sites for files containing sensitive data. Based on the selected scan action, matching files are encrypted or decrypted. Scan & Encrypt consists of the following sections:
SectionDescription
Target DiscoveryIdentify file servers and SharePoint sites available for scanning.
Devices/Services FoundView and manage file servers and SharePoint sites identified through discovery jobs.
ScansCreate one-time or ongoing scan jobs for selected file servers and SharePoint sites.
ResultsReview the list of files encrypted or decrypted in completed scans.
Agent DevicesMonitor and manage Agent Devices registered to your environment.
## Target Discovery Target Discovery identifies the file shares and SharePoint sites available for scanning in your environment. Before running scans, targets must be discovered. Once a discovery job completes, the discovered file servers and SharePoint sites appear under [PROTECT > Repository Files > Devices/Services Found](#devices-services-found). ### Discover File Shares to Scan Create a new target discovery job for Devices to find file shares within a specified IP range. 1. Navigate to **PROTECT** > **Repository Files > Target Discovery**. 2. Click **Devices** and select **+New Target Discovery**.
3. In the **Discovery Job Name** field, enter a descriptive name that identifies the purpose of the job (e.g., Finance Department Workstations, Sydney Office Network Scan). 4. In the **Target IP Range** field, enter the IP address range where DISCOVER should search for devices (e.g., `192.168.1.100` ). 5. Select the **Location** filter to narrow the list of available Agents by their assigned location. 6. Select the **Agent** you want to use. 7. Select the **Authentication** method: 1. **Username + Password**: Select this option to authenticate using SMB credentials. Enter the **Username**, **Password**, and **SMB Location**. 2. **Certificate + Password**: Select this option to authenticate using a certificate. Upload the certificate file and enter the associated password. 8. Set the **Connection Retry Frequency** to define how often the system will attempt to reconnect if the initial connection fails. Shorter intervals result in faster retries but increased network traffic; longer intervals reduce network load but slow down discovery. 9. Set the **Connection Timeout After** to define how long the system will continue attempting to establish a connection before marking the target as unreachable. 10. Click **Save**.
GuardWare begins connecting to File shares within the specified IP range. The discovery job appears in the Target Discovery list. ### Discover Services to Scan Create a new target discovery job for Services to connect to SharePoint Online. 1. Navigate to **PROTECT** > **Repository Files > Target Discovery**. 2. Click **Services** and select **+New Target Discovery**.
3. Enter a descriptive **Discovery Job** name. 4. Provide your SharePoint organisation name, Tenant ID, and Client ID. 1. **SharePoint Organisation:** The first part of your SharePoint URL (e.g., if your URL is `https://organisation.sharepoint.com`, enter `organisation`). 2. **SharePoint Tenant ID:** Same as Exchange Tenant ID. 3. **SharePoint Client ID:** The Application (Client) ID of your registered SharePoint application in Azure AD. 5. Select the **Location** to filter the list of Agents by their assigned location. 6. Select the **Agent** you want to use. 7. Set the **Connection Retry Frequency** to define how often GuardWare will attempt to reconnect if the initial connection fails. Shorter intervals result in faster retries but increased network traffic; longer intervals reduce network load but slow down discovery. 8. Set the **Connection Timeout After** to define how long GuardWare will continue attempting to connect before marking the target as unreachable. 9. Click **Save**.
## Devices/Services Found Devices/Services Found lists all file servers and SharePoint sites identified through completed discovery jobs. This is also where you reassign a discovered location to a different Agent Device. Each entry shows the hostname, assigned Agent Device, category, last activity, and current status.
### Reassign Agent 1. Navigate to **PROTECT** > **Repository Files >** **Devices/Services Found**. 2. Select one or more file servers or SharePoint sites and click **+Reassign Agent**. 3. Select the new Agent device from the list and click **Save**.
4. In the pop-up window, click **Assign.** ## Scans Agents scan selected file servers and SharePoint sites for files containing sensitive data. Two scan types are available: * **One-Time Scan**, which runs a single, non-recurring scan on selected devices and services. * **Ongoing Scan**, which runs a recurring scan on selected devices and services. {% hint style="info" %} If you are running Scan & Encrypt for the first time, start with a one-time scan on a single file server or SharePoint site. This lets you confirm the configured data types and scan action before you set up an ongoing scan. {% endhint %} ### One-Time Scan Use a one-time scan to validate the configuration on a limited scope first. The agent checks files and, if sensitive data is present, encrypts or decrypts them based on the selected scan action. 1. Navigate to **PROTECT** > **Repository Files >** **Scans** and click **+New Scan**.
2. Select **One-Time Scan** and click **Proceed**.
3. Enter a **Scan Name** that clearly identifies the purpose of the scan (e.g., *Finance SharePoint - Credit Card Check*). 4. Add an optional **Description** for context and click **Next**. 5. Select the **Data Types** you want to scan and click **Next**.
6. Select the devices and/or SharePoint sites to scan, then click **Next**.
7. Select a [**Scan Action**](#scan-action) if encryption or decryption is required, then click **Next**. 8. **Filter Directories and File Types**: This setting allows you to include or exclude specific folders and file types from the scan. You have multiple options for controlling which folders and file types are scanned:

If you skip this configuration, GuardWare will scan all folders and file types in every selected target for sensitive data.

1. **Scan only the selected folders and file types:** Limit the scan to specific locations and file formats. Only what you explicitly select is scanned. Use this when you already know where sensitive data is likely to exist and want to focus the scan there instead of scanning everything.
* **Enter custom folder path:** Click **+Add** to include folders to scan. Enter the full path (e.g., `C:\Users\Public\Documents`, `\\fileserver\HR\Payroll`). Add multiple paths as needed. Only these folders are scanned. * **Include all file types:** Enable **Include all file types** to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only. * **Include custom file extension:** Click **+Add** to specify extensions for uncommon or proprietary file extensions not in GuardWare's file type list. Only files having these extensions will be scanned.
2. **Scan all content except the selected folders or file types:** Use this when you want broad coverage while skipping known irrelevant areas, such as system folders, logs, or temporary folders. * **Enter custom folder path:** Click **+Add** to specify folders to exclude. Enter the full path (e.g., `C:\Windows\Temp`, `\\fileserver\Backups`, `D:\Logs`). These folders are skipped during the scan. * **Exclude all file types:** Enable **Exclude all file types** to skip file content scanning entirely and examine only file metadata, such as filenames and paths. This is rarely used and typically needed only for filename-based data types. * **Enter custom file extension:** Click **+Add** to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., `.backup`, `.cache`).
9. Click **Next**. 10. Review the scan configuration summary and click **Save**. The scan starts automatically and appears in the Scans list with the progress and status indicators. ### Ongoing Scan Use an ongoing scan after you have validated the configuration with a one-time scan. This is the right option when the same file server or SharePoint site needs recurring coverage. 1. Navigate to **PROTECT** > **Repository Files >** **Scans** and click **+New Scan**. 2. Select **Ongoing Scan** and click **Proceed**.
3. Select the **Data Types** you want to scan and click **Next**.
4. Select the file servers and/or SharePoint sites to scan, then click **Next**.
5. Select a [**Scan Action**](#scan-action) if encryption or decryption is required, then click **Next**.
6. **Filter Directories and File Types**: This setting allows you to include or exclude specific folders and file types from the scan. You have multiple options for controlling which folders and file types are scanned:

If you skip this configuration, GuardWare will scan all folders and file types in every selected target for sensitive data.

1. **Scan only the selected folders and file types:** Limit the scan to specific locations and file formats. Only what you explicitly select is scanned. Use this when you already know where sensitive data is likely to exist and want to focus the scan there instead of scanning everything. * **Enter custom folder path:** Click **+Add** to include folders to scan. Enter the full path (e.g., `C:\Users\Public\Documents`, `\\fileserver\HR\Payroll`). Add multiple paths as needed. Only these folders are scanned. * **Include all file types:** Enable **Include all file types** to scan all supported formats (documents, spreadsheets, presentations, images, archives, emails). Disable it to limit scanning to specific extensions only. * **Include custom file extension:** Click **+Add** to specify extensions to scan uncommon or proprietary file extensions not in GuardWare's file type list. Only files having these extensions will be scanned.
2. **Scan all content except the selected folders or file types:** Use this when you want broad coverage while skipping known irrelevant areas, such as system folders, logs, or temporary folders. * **Enter custom folder path:** Click **+Add** to specify folders to exclude. Enter the full path (e.g., `C:\Windows\Temp`, `\\fileserver\Backups`, `D:\Logs`). These folders are skipped during the scan. * **Exclude all file types:** Enable **Exclude all file types** to skip file content scanning entirely and examine only file metadata, such as filenames and paths. This is rarely used and typically needed only for filename-based data types. * **Enter custom file extension:** Click **+Add** to specify extensions to exclude uncommon or proprietary extensions you don't want scanned (e.g., `.backup`, `.cache`).
7. Set a schedule to define when and how often the scan runs. 1. In **REPEAT FREQUENCY**, enter how frequently the scan should run. 1. **Select an interval:** Choose how often the scan repeats. 2. **Select a time:** Choose when the scans start.\ Example: Selecting **2** Months at **6:00 PM** repeats the ongoing scan every 2 months at 6:00 PM.
2. Choose the **Scan Start** date: 1. **On Date:** Select a calendar date when the first scan should run. The scan will start on this date and then repeat according to the interval you set. 2. **Relative:** Select a specific period and day (Monday, Tuesday, etc.) when scans should run. This is useful for scheduling scans during low-activity periods (e.g., 1st Sunday).
3. Ongoing scans can be resource-intensive (high CPU usage, network traffic, disk I/O); it's best to schedule them during off-hours when they won't impact user productivity. Use the **Avoid Scans Window** setting to define periods during which scheduled scans must not run, even if they are due to start. 1. Click **+Add avoid window** to add a restriction. 2. Select the day(s) of the week when scans should be avoided. Select the time range to avoid (e.g., 8:00 AM to 6:00 PM for business hours). You can add multiple avoid time windows to accommodate different schedules.
4. Beside the schedule, you'll find the **Terminate Current Scan** option. 1. Enable **Terminate Current Scan** to stop any scan that is currently running when the newly configured ongoing scan starts. 2. Leave **Terminate Current Scan** disabled if you want the current scan to finish first.

Note when Terminate Current Scan is disabled:

If the current scan runs past the scheduled start time of the new scan, the new scan will not run for that occurrence. It will wait until the next scheduled slot, whether that is the following week or month. This can create a gap in scheduled coverage, so keep this in mind when setting scan times.

8. Click **Next**. 9. Review the details and click **Save** to initiate the scan. The scan starts automatically and appears in the Scans list with a status indicator. The schedule runs automatically until the scan is disabled or deleted. ### Scan Action Scan Action defines what happens when the agent identifies a file containing sensitive data. The selected action is carried out by GuardWare PROTECT.
Scan ActionDescription
Encrypt on ScanFiles containing sensitive data are copied to the Agent Device, analysed, and if sensitive data is confirmed, encrypted and copied back to their original location. Encryption is based on the security group assigned to the matching data type in Encrypt by Data Type. Only one scan action can be selected per scan.
Decrypt on ScanEncrypted files containing sensitive data are copied to the Agent Device, analysed, and if confirmed, decrypted and copied back to their original location. Decryption is based on the security group assigned to the matching data type in Encrypt by Data Type.
For Scan Action to function correctly, the following must be configured beforehand: * In [**PROTECT** **> Protection Scope >** **Active Data Types**](/documentation/protect/protection-scope/encrypt-by-data-type.md), each relevant Data Type must be defined, enabled, and have a Security Group assigned. * In [**SECURITY GROUPS**](/documentation/management-console/security-group/security-group.md), a Security Group must be created with the relevant users added. * For Microsoft Office files, configure the applicable PROTECT settings in [**PROTECT > Classification Settings**](/documentation/protect/encryption-and-policies/classification-protection-settings.md). ## Results All files encrypted or decrypted in completed scans are listed on the **Results** page, organised by target type, either file servers or SharePoint. Use the filter controls at the top of the page to narrow results by scan job, target, or data type.
Each record shows the file location, matched data types, sensitivity classification, number of matches, and the current file status, including whether it has been encrypted or decrypted. ## Agent Devices Agent Devices show the Windows services installed across your environment that run discovery and scan jobs.
Each entry shows the Agent Device's name, assigned location, online status, last seen timestamp, and installed version. If an Agent Device appears as offline or unreachable, verify that the host device is powered on, connected to the network, and that the Agent is running. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.guardware.com/documentation/protect/scan-and-encrypt/scan-and-encrypt.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.