Using UNC shares as distributed repositories

Use an alternate method to write to your repository — Log on to the server using other methods (another share, RDP, locally) to write to your repository. Do not mix the repository you read from with the repository you write to. Read credentials are shared with endpoints, and write credentials are used exclusively by the ePO - On-prem server to update your distributed repository content.

Do not use a share on your Domain Controller — Create a share off your domain controller. A local user on a domain controller is a domain user.

Grant your UNC share account read-only rights for everyone except the ePO - On-prem server main repository — When you set up your share, make sure that the account you created has read-only rights to the directory and to the share permissions. Do not grant remote writing to the share (even for administrators or other accounts). The only account allowed access is the account you recently created.

Important

The ePO - On-prem server Main Repository must be able to write files to the UNC share account.

Create the account locally — Create the account on the file share, not on the domain. Accounts created locally do not grant rights to systems in the domain.

Use a specific account — Create an account specifically for sharing repository data. Do not share this account with multiple functions.

Make the account low privilege — Do not add this account to any groups it does not need, which includes "Administrators" and "Users" groups.

Disable extraneous privileges — This account does not need to log on to a server. It is a placeholder to get to the files. Examine this account's permissions and disable any unnecessary privileges.

Use a strong password — Use a password with 8–12 characters, using multiple character attributes (lowercase and uppercase letters, symbols, and numbers). We recommend using a random password generator so that your password is complex.

Firewall your share — Always block unnecessary traffic. We recommend blocking outgoing and incoming traffic. You can use a software firewall on the server or a hardware firewall on the network.

Enable File Auditing — Always enable security audit logs to track access to your network shares. These logs display who accesses the share, and when and what they did.

Change your passwords — Change your password often. Make sure that the new password is strong, and remember to update your ePO - On-prem configuration with the new password.

Disable the account and share if it's no longer used — If you switch to a different repository type other than UNC, remember to disable or delete the account, and close and remove the share.