Scan & Encrypt

The Scan & Encrypt functionality locates and encrypts files with sensitive data located in file servers and SharePoint. Agents scan selected file servers and SharePoint sites for files containing sensitive data. Based on the selected scan action, matching files are encrypted or decrypted.

Scan & Encrypt consists of the following sections:

Section	Description
Target Discovery	Identify file servers and SharePoint sites available for scanning.
Devices/Services Found	View and manage file servers and SharePoint sites identified through discovery jobs.
Scans	Create one-time or ongoing scan jobs for selected file servers and SharePoint sites.
Results	Review the list of files encrypted or decrypted in completed scans.
Agent Devices	Monitor and manage Agent Devices registered to your environment.

Target Discovery

Target Discovery identifies the file shares and SharePoint sites available for scanning in your environment. Before running scans, targets must be discovered. Once a discovery job completes, the discovered file servers and SharePoint sites appear under PROTECT > Devices/Services Found.

Discover File Shares to Scan

Create a new target discovery job for Devices to find file shares within a specified IP range.

1. Navigate to PROTECT > Target Discovery.
2. Click Devices and select +New Target Discovery.

   
3. Enter a job name and define the target IP range.
4. Select a Location and Agent.
5. Select the Authentication method

   1. Username + Password: Select this option to authenticate using SMB credentials. Enter the Username, Password, and SMB Location.
   2. Certificate + Password: Select this option to authenticate using a certificate. Upload the certificate file and enter the associated password.
6. Set the Connection Retry Frequency to define how often the system will attempt to reconnect if the initial connection fails. Shorter intervals result in faster retries but increased network traffic; longer intervals reduce network load but slow down discovery.
7. Set the Connection Timeout After to define how long the system will continue attempting to establish a connection before marking the target as unreachable.
8. Click Save.

Discover Services to Scan

Create a new target discovery job for Services to connect to SharePoint Online.

1. Navigate to PROTECT > Target Discovery.
2. Click Services and select +New Target Discovery.

   
3. Enter a job name and select SharePoint from the Cloud Connector drop-down.
4. Provide your SharePoint organisation name, Tenant ID, and Client ID.
5. Provide either a client secret or a certificate for authentication.
6. Click Save.

For full configuration details and field descriptions, see Target Discovery.

Devices/Services Found

Devices/Services Found lists all file servers and SharePoint sites identified through completed discovery jobs. This is also where you reassign a discovered location to a different Agent Device. Each entry shows the hostname, assigned Agent Device, category, last activity, and current status.

Reassign Agent

1. Navigate to Scan & Encrypt > Devices/Services Found.
2. Check the box next to one or more file servers or SharePoint sites and click +Reassign Agent.

   
3. Select the new agent device from the list, and click Save.
4. In the pop-up window, click Assign.

Scans

Agents scan selected file servers and SharePoint sites for files containing sensitive data. Two scan types are available:

• One-Time Scan, which runs once across the selected targets,
• Ongoing Scan, which runs on a recurring schedule.

If you are running Scan & Encrypt for the first time, start with a one-time scan on a single file server or SharePoint site. This lets you confirm the configured data types and scan action before you set up an ongoing scan.

One-Time Scan

Use a one-time scan to validate the configuration on a limited scope first. The agent checks files and, if sensitive data is present, encrypts or decrypts them based on the selected scan action.

1. Navigate to Scan & Encrypt > Scans and click +New Scan.
2. Select One-Time Scan and click Proceed.
3. Enter a scan name and an optional description, then click Next.
4. Select the file servers and/or SharePoint sites to scan, then click Next.
5. Select a Scan Action if encryption or decryption is required, then click Next.
6. Choose which directories the agent should scan and click Next.
7. Click Save to initiate the scan.

Ongoing Scan

Use an ongoing scan after you have validated the configuration with a one-time scan. This is the right option when the same file server or SharePoint site needs recurring coverage.

1. Navigate to Scan & Encrypt > Scans and click +New Scan.
2. Select Ongoing Scan and click Proceed.
3. Select the file servers and/or SharePoint sites to scan, then click Next.
4. Select a Scan Action if encryption or decryption is required, then click Next.
5. Choose which directories the agent should scan and click Next.
6. Set the scan schedule and click Next.
7. Click Save to initiate the scan.

Scan Action

Scan Action defines what happens when the agent identifies a file containing sensitive data. The selected action is carried out by GuardWare PROTECT.

Scan Action	Description
Encrypt on Scan	Files containing sensitive data are copied to the Agent Device, analysed, and if sensitive data is confirmed, encrypted and copied back to their original location. Encryption is based on the security group assigned to the matching data type in Encrypt by Data Type. Only one scan action can be selected per scan.
Decrypt on Scan	Encrypted files containing sensitive data are copied to the Agent Device, analysed, and if confirmed, decrypted and copied back to their original location. Decryption is based on the security group assigned to the matching data type in Encrypt by Data Type.

For Scan Action to function correctly, the following must be configured beforehand:

• In PROTECT > Encrypt by Data Type, each relevant Data Type must be defined, enabled, and have a Security Group assigned.
• In PROTECT > Security Groups, a Security Group must be created with the relevant users added.
• For Microsoft Office files, configure the applicable PROTECT settings in ORGANISATION > Integrations. See PROTECT Office for more details.

Results

All files encrypted or decrypted in completed scans are listed in the Results page, organised by target type, either file servers or SharePoint. Use the filter controls at the top of the page to narrow results by scan job, target, or data type.

Each record shows the file location, matched data types, sensitivity classification, number of matches, and the current file status, including whether it has been encrypted or decrypted.

Agent Devices

Agent Devices show the Windows services installed across your environment that run discovery and scan jobs.

Each entry shows the Agent Device's name, assigned location, online status, last seen timestamp, and installed version. If an Agent Device appears as offline or unreachable, verify that the host device is powered on, connected to the network, and that the Agent service is running.

Request Logs

To request logs:

1. Navigate to PROTECT > Agent Devices.
2. Search for the device whose logs you want to request and click Request Log in the LOGS column.

   
3. Choose one of the following log types:

Log Type	Description
Service	Logs related to the Agent Device service’s activity, including its operations, status, communication, and errors.
Scan	Logs related to scan jobs carried out by the Agent Device.
Target Discovery	Logs related to target discovery jobs run by the Agent Device.
Investigation	Logs related to file investigation activity run by the Agent Device.
Remediation	Logs related to remediation actions performed by the Agent Device.

1. Select the date range and click Request Logs.
2. Once the logs are ready, a Download icon appears in the LOG STATUS column. Click the icon to download the logs.