﻿
========================================================================
 Management tool of file and folder access authority for Windows

 - File Authority Designer -

 Manufacturer : Exceedone Co., LTD.

========================================================================

In this file, we explain the usage and other important information
 of "File Authority Designer".
(hereafter, written as this product)

Please refer Exceed One (hereafter written as we) Web-Site 
for the latest information.


------------------------------------------------------------------------
A table of contents
------------------------------------------------------------------------

1. Summary of application
2. Operation environment
3. Kinds of production
4. Contract of consent of usage
5. How to use
6. Inquiry / how to purchase
7. Others
8. Record of renewal



------------------------------------------------------------------------
1.Summary of application
------------------------------------------------------------------------

This product can indicate folder and access authority list of Windows,
 and setup access authority.

[Summary of function]
Local authority and domain authority can be treated at the same time
•Showing access authority list
•Addition, change and deletion of access authority
•Output access authority list (EXCEL)


------------------------------------------------------------------------
2. System Requirements
------------------------------------------------------------------------
OS
　•Microsoft Windows Server 2008 / R2
　•Microsoft Windows Server 2012 / R2
   *Verification in Standard Edition.
   *ReFS is not supported.

　•Microsoft Windows 7
　•Microsoft Windows 8, 8.1
　•Microsoft Windows 10
   *Verification in Professional Edition

.Net Framework
　•.NetFramework 4.5
  *Microsoft Windows Server 2016 works with .Net Framework 4.6 backward
    compatibility.

　
------------------------------------------------------------------------
3. Kinds of production
------------------------------------------------------------------------

This product has following kinds(edition) according to function and
 license form.

[ Free Edition ]
•Free of charge.
•It has limitation a part of function.
•Purchase license and transfer "Professional Edition"

[ Enterprise Edition ]
•Liable for the cost of usage.
•All function of this product is available.


------------------------------------------------------------------------
4. Software License Terms and Conditions
------------------------------------------------------------------------

To use this product, you are requested to agree with 
 "Software License Terms and Conditions" written on a separate sheet.
If you do not agree, you can not use this product.
Apply following individual condition only for "Free Edition".

[ Individual condition of Free Edition ]
"Free Edition" of limited function of this product is free of charge.


------------------------------------------------------------------------
5. How to use
------------------------------------------------------------------------

[ Install ]
•Create a reasonable folder, and copy unzipped folder to random position.
•Runs REGADD.EXE with administrator privileges. 
It is all to install.

[ Uninstall]
•Delete file with folder when it is made on install.

Remarks:
This product will register an EventLog information in the registry.

------------------------------------------------------------------------
6. Inquiry / How to purchase
------------------------------------------------------------------------
Please refer our website and product URL for inquiry of this product
 and purchasing license.

Manufacturer / Sales : Exceedone Co., ltd

[ Web-Site ]
http://www.exceedone.com/

[ Production URL ]
http://www.exceedone.com/fad_en/


------------------------------------------------------------------------
7. Other
------------------------------------------------------------------------

Company name and product name of text are each company's trademarks.


------------------------------------------------------------------------
8. History
------------------------------------------------------------------------
January/01/2017 ver 3.0.0.0
	Release:Add the batch processing that can modify access permissions.

Febrary/28/2017 ver 3.0.1.0
	Fixed a problem occurring when connecting by UNC.

March/10/2017 ver 3.0.2.0
	User search function added with "Display Name".

April/28/2017  ver 3.0.4.0
	Access right display function added with shared folder.
	Added function to colorize inheritance state to folder tree.

May/31/2017  ver 3.0.5.0
	Fix:Failure to search in "Display Name".

Outober/16/2017  ver 3.0.6.0
	Fixed function to colorize inheritance state to folder tree.
	Added display of ownership to authority tab.
	Added prefetching function of folder tree.

December/21/2017 ver 3.0.7.0
	Specification change of function to take ownership.
	Change a icon display method.
	Fixed a bug that an error occurred at start-up.

September/02/2019 ver 3.0.9.0
	For servers operating in a workgroup Fix the bug that can not change the access right when switching batch mode.
	Fixed a bug that normal mode is performed when switching batch mode.
	Fixed a bug that the account name cannot be searched if it contains special characters (eg (,), *).
	Added to the menu to disable the setting / display of ownership. * When using Panzura (CIFS compatible server), it may freeze if you acquire ownership.
	Changed the number of users of output Excel from 2000 columns to 10000 columns.
	When the application is terminated during output, a confirmation message is displayed.
	Added status (OK / NG) to log (Evnetlog) output in batch mode.
	Made the executable file (EXE) of the professional edition and enterprise edition the same. * Editions can be switched by license key.
	Signed the application with a code signing certificate.
	Added to the menu so that the output of Eventlog and FADEventlog.tsv can be disabled. * The Eventlog can be disabled for high-speed processing.	
	Regarding the limit of 260 characters in the file path (259 characters because the last is NULL), 32768 characters are supported for local drives / network drives. (The unc path is not supported, so mount it on a network drive.)
October/01/2019 ver 3.0.9.3
	The permission inherited in the output Excel has been modified to be enclosed in [].
	The separator for the output Excel user account and name was changed from "()" to ";".
October/16/2019 ver 3.0.9.4
	The user name of output Excel is displayed as it is in the case of Builtin User. (In the future, when implementing the function to import authority from Excel, it will be impossible to import the user name as it is)
October/23/2019 ver 3.0.9.5
	Undo correction of ver 3.0.9.4
	Fixed display of UserMatrix path (removing "//?/")
October/28/2019 ver 3.0.9.7
	Even if there are some privileges that cannot be added by applying batch mode, the privileges are updated.
January/08/2020 ver 3.0.9.8
	It is now possible to resolve trusted forest usernames.
	Example (S-1-5-21-3620177325-830373916-1996657551-513　-> trustedForestA_Domain1\user1)
February/03/2020 ver 3.0.9.9
	The title "Run as administrator (On / Off)" is displayed.
	The title "Long pass support (On / Off)" is displayed.
	Long path "local drive / network drive / UNC" is supported. (Requires ".NET 4.6.2" or higher)
	Fixed an error that the permission cannot be read if it is less than ".NET4.6.2".
February/04/2020 ver 3.0.9.10
	Fixed a bug that ownership cannot be set.
June/08/2020 ver 3.0.9.11
	Fixed a bug that the tree hierarchy and file name were not output correctly when a report was output from the command line.
	Defect example [FileFullPath] "c:\test\xxx.docx" is displayed as [FileName] "est\xxx.docx". (The correct answer is displayed as "xxx.docx")
November/23/2020 ver 3.0.9.12
	"Filter OU" has been added to the "Search" condition on the "User List" screen.
June/07/2021 ver 3.0.9.13
	Since the form size of the user list is automatically adjusted depending on the PC environment, some check boxes may not be displayed, so it has been fixed so that it does not depend on the PC environment.
June/25/2021 ver 3.0.9.14
	Fixed a bug that shared permission information (excluding management sharing) could not be read when "Permission (Tab) / Sharing (Tab)" was selected.
July/09/2021 ver 3.0.9.15
	Output tab: Reduction of permission display data
		Display pattern
			[F]      * [M]           This display is included, so it will not be displayed again.
			[M]      * [E], [R], [W] This display is included, so change it so that it is not displayed.
			[E]      * [R]           This display is included, so change it so that it is not displayed.
			[E], [W]
			[R], [W]
			[R]
			[W]
May/08/2025  ver 3.0.9.16
	Fixed a bug that searching for members on the user account information display screen was not possible if the domain was a trusted another domain.
May/25/2025  ver 3.0.9.17
	Fixed from .NET Framework 4.5 to 4.6 or later.
	Fixed a bug that searching for members on the user account information display screen was not possible if the domain was a trusted another domain.(Fixed it again.)
May/26/2025  ver 3.0.9.18
	Screen: User account display, Output: Fixed a bug where the SID (S-1-5-21-xxxxxxx) was displayed as is when the UserMatrix member was from a trusted domain.
May/27/2025  ver 3.0.9.19
	In the case of "ForeignSecurityPrincipals", when searching AD, it was sometimes not possible to search as normally without specifying an explicit domain, so this has been fixed.
June/09/2025  ver 3.0.9.20
	If LDAP cannot be searched due to LDAP authentication problems, you can now register "Menu/LDAP Password" to search LDAP.
	For example, LDAP may not be searchable if the "User authentication scope" of the "Trusted domain" in the "Domain trust relationship" is set to "Selective authentication."
September/2/2025  ver 3.0.9.21
	Fixed an issue where the settings file would not be updated when executing "Open Settings File" in "Batch Mode (Enterprise Edition)".
	Prerequisite: This issue occurs when "Long Path Support (On)" is enabled.
	Note: After "Open Settings File," the settings are updated, but the "Folder/File" color does not immediately turn red. The red color is applied when you click "Folder/File."
2026/01/25  ver 3.0.9.22
	Added saving and loading of user settings for the Output tab when the application exits and starts.
		- Settings saved/loaded (stored in `FADConfig.xml`)
			- `CheckBoxOutputFile` (show file list: on/off)
			- `CheckBoxOutputTree` (show tree hierarchy: on/off)
			- `CheckBoxOutputTimeStamp` (show timestamps: on/off)
			- `CheckBoxOutputSize` (show file size + file count: on/off)
			- `NumericUpDownOutputTreeLevel` (maximum output tree level)
			- `CheckBoxOutputAutholity` (include authority/permissions in output: on/off)
			- `CheckBoxOutputShareFolder` (share folder option: on/off)
			- `CheckBoxOutputAutholitySort` (authority sort: on/off)
			- `CheckBoxOutputUserMatrix` (user matrix: on/off)
2026/10/27  ver 3.0.9.23
	Improved the speed of the authority output. The output contents are unchanged.
		- The result of converting a SID to an account name is cached, so each SID is converted only once.
		- The ACL is no longer read twice to display the owner.
		- On a network (UNC path), the authorities of the folders/files to be output next are read ahead in parallel.
		- When the owner is a SID that cannot be converted to a name (such as a deleted account), the accounts on the file server are no longer searched again each time.
		  Example: If there were many folders owned by a deleted account, it took several seconds per folder.
		- The list of domain controllers is now retrieved only once. In environments where the retrieval fails (e.g., a domain controller cannot be reached),
		  the domain was queried for each folder/file.
		- When an LDAP search fails for a domain (e.g., a trusted domain whose LDAP password is not registered), that domain is no longer
		  queried again within the same output. It used to wait several seconds for each account.
		- Reference (file server in a domain environment, 30,000 items): 149 seconds -> 26 seconds
2026/10/27  ver 3.0.10.0
	Added a "Reverse Lookup (User)" sheet to the authority output. It lists, for each account, the folders/files on which the account has permissions set directly.
		- It is output when "Reverse Lookup (User)" in the Option of the Output tab is on (default: off).
		  The setting is saved when the application exits (`CheckBoxOutputReverseLookup` in `FADConfig.xml`).
		- On the command line (FADCmd), specify /reverse true|false.
		- Columns: No / Account / Display Name / Full Path / Type / Permission / Grant / Deny / FAD Row (the row on the FAD sheet)
		- Grant:
			Set directly             : only permissions set directly on the folder/file
			Set directly + inherited : both permissions set directly and permissions inherited from the parent folder
			Inherited only           : only permissions inherited from the parent folder (output only when "Reverse inherited" is on)
		- Permissions only inherited from the parent folder (Inherited only) are omitted, because they can be found from the row of the parent folder.
		  To output all of them, turn on "Reverse inherited" under "Reverse Lookup (User)" (default: off).
		  The setting is saved when the application exits (`CheckBoxOutputReverseLookupInherited` in `FADConfig.xml`).
		  On the command line (FADCmd), specify /reverseinherited true|false.
		  Note: There are very many "Inherited only" rows (e.g., about 220,000 rows for 30,000 items). If the number of rows exceeds the limit, the accounts later in name order are not output.
		- If the number of rows exceeds the sheet limit, the output is truncated and a message is displayed.
	On the command line (FADCmd), a message is now also displayed on the console when the output is truncated because the number of rows on the authority list (FAD sheet) or the reverse lookup (user) sheet exceeds the limit.
	In this case, the exit code (%ERRORLEVEL%) is 3 (the rows already output are saved).
		Exit codes: 0 = success, 1 = abnormal termination, 2 = not executed (help, etc.), 3 = truncated by the row limit
2026/10/31  ver 3.0.11.0
	Added the audit report (changes in permissions). It compares two authority outputs (xlsx) and lists the changes in permissions, owners, inheritance, and folders/files.
		- Select "Tool" -> "Audit Report (Changes in Permissions)..." and specify the previous output, the current output, and the destination.
		- The xlsx has a "Summary" sheet (counts) and a "Changes" sheet (one row per change).
		  Columns of the Changes sheet: No / Kind (Added / Removed / Changed) / Target (Permission / Owner / Inheritance / Folder / file) / Full Path / Type / Account / Display Name / Previous / Current / Grant / Deny
		- Rows are matched by the full path and the account name, so the outputs can be compared even if the column order (e.g., sorting) differs.
		- Changes in permissions only inherited from the parent folder (Inherited only) are not listed by default (only the folder where the change was made is listed).
		  Turn on "Also list changes in inherited permissions" to list all of them.
		- Renaming or moving a folder, or renaming an account, appears as "Removed + Added".
		- On the command line (FADCmd): FADCMD.EXE /diff previous.xlsx current.xlsx [/file report] [/diffinherited true|false]
		  Exit codes: 0 = no changes, 4 = changes, 3 = truncated by the row limit, 1 = error, 2 = not executed
	Added the effective access of user. It lists, from an authority output (xlsx), the folders/files on which the user or the groups of the user (including nested groups) have permissions.
		- Select "Tool" -> "Effective Access of User..." and specify the account (e.g., VEGA\taro), the authority output, and the destination.
		- The groups of the user are obtained from AD (including nested groups). The groups that everyone belongs to (Everyone, Authenticated Users, Users) are also included.
		  If AD cannot be searched (e.g., a trusted domain whose LDAP password is not registered), only the user and the groups that everyone belongs to are checked.
		- Membership of local groups on the file server is not considered (it is considered when the file server is a domain controller).
		- Columns: No / Full Path / Type / Via (account) / Kind (User / Group / Everyone) / Display Name / Permission / Grant / Deny
		- Permissions only inherited from the parent folder are not listed by default (turn on "Also list inherited permissions" to list them).
		- On the command line (FADCmd): FADCMD.EXE /access account output.xlsx [/file report] [/accessinherited true|false]
		  Exit codes: 0 = success, 3 = truncated by the row limit, 1 = error, 2 = not executed
	Added the list and removal of deleted accounts. It lists, from an authority output (xlsx), the permissions and owners of SIDs that cannot be converted to a name (deleted accounts), and removes the permissions if specified.
		- Select "Tool" -> "Deleted Accounts (List and Remove)...", specify the authority output, and click "Check". The permissions and owners found are listed on the screen.
		  Checking does not change anything. The list can be saved to an xlsx file with "Save the list...".
		- Only SIDs of domain accounts (S-1-5-21-) are listed. Permissions only inherited from the parent folder are not listed. Owners are listed but not changed.
		- Click "Remove..." to show the count and a 4-digit number. Only when the number is entered, the permissions set directly (both allow and deny) are removed. This cannot be undone.
		  After removal, the removed permissions are listed on the screen, and a removal report (xlsx) is saved automatically in the folder of the authority output (it can also be saved elsewhere with "Save the removal report...").
		  Only SIDs whose status is "Deleted" are removed (it is confirmed that the SID still cannot be converted to a name and that the domain can be queried).
		  SIDs of a domain that cannot be queried (status "Cannot be confirmed") are not removed.
		- Columns: No / Full Path / Type / Target (Permission / Owner) / SID / Status / Permission / Grant / Deny / Result. The "SID" sheet shows the counts for each SID.
		- On the command line (FADCmd): FADCMD.EXE /orphan output.xlsx [/file report] [/remove true|false]
		  /remove true (remove the permissions) is a feature of the Enterprise Edition.
		  Exit codes: 0 = none found (list) or success (remove), 4 = found (list), 3 = truncated by the row limit, 1 = error, 2 = not executed
	The look of the screens has been updated.
		- The font is now Yu Gothic UI (Meiryo UI if it is not installed), and buttons and input boxes have flat borders. The main buttons (such as Output and Commit) are shown in blue.
		- Text is no longer blurred on PCs with display scaling (such as 125% or 150%).
2026/10/31  ver 3.0.12.0
	You can now type a path in the address bar and press Enter to go to that folder (as in Explorer).
		- Examples: C:\Share, Z:, \\server\share\dept. A trailing "\" is optional. For a file path, the folder is opened and the file is selected.
		- A network path is added under "My Network" and opened. A message is displayed if the path does not exist. Press Esc to restore the input.
	"Domain servers (domain name)" is now displayed in the tree. Expanding it shows the servers registered in Active Directory and their shared folders.
	When folders/files are created, deleted, or renamed in the displayed folder, the tree and the file list are now updated automatically.
	The file list now shows the icons of the file types (Word, Excel, PDF, etc.). The file list is displayed faster (e.g., a folder with 4,400 items: 2.2 s -> 1.8 s).
	Added "Output inherited" to the authority output. When it is off, folders/files with the same permissions as the parent folder (inherited only) are not output, which greatly reduces the number of rows.
		- Folders down to "Always output levels" are output even if they are inherited only (the target folder is level 1, default 2). The condition area of the output shows "Output inherited: off (always output levels)".
		- Example: a folder that is mostly inherited only: 2,705 rows -> 19 rows.
		- When the audit report compares an authority output made with "Output inherited" off, added/removed folders/files are not listed (a message is displayed).
		- On the command line (FADCmd): /omitinherited true|false (default false), /keeplevel number (default 2)
	The options of the Output tab are grouped into "Rows", "Columns", and "Extra sheets".
	The "Replace (all child objects)" button is now "Replace (child objects)", and the wording of the confirmation matches Explorer.
	Added a display for "Commit" when it takes time.
		- The folders/files under it are counted, and if it is likely to take a minute or more, the count and an estimated time are shown for confirmation.
		- If it takes a second or more, the elapsed time, the count, and the estimated remaining time are shown. Windows applies the permissions to all folders/files under it at once, so it cannot be stopped partway.
	The elapsed time, the number of items processed, and the total number are now shown during the authority output.
	Added "Tool" -> "Log".
		- Record a detailed log (for troubleshooting), Open the log folder, Save the log for support (names hidden / as is).
		- "Names hidden" replaces user, group, folder, server, and domain names with codes and saves them to a zip (the table of codes is kept on this PC).
		- The application log is recorded in log\FAD_yyyyMMdd.log (one line per entry, tab-separated).
	The look of the dialogs (Add user, Take ownership, License, etc.) has been updated.
	The audit report now also lists changes in inherited-only permissions for folders whose inheritance was changed.
	Bug fixes
		- FADCmd /dir terminated abnormally when /file was omitted or the folder did not exist. When /file is omitted, FAD_datetime.xlsx (txt) is created in the current folder.
		- When "Prefetch of folder" was on, the first move from the address bar sometimes stopped at the drive or the share.
		- "Commit" in batch mode no longer shows the time confirmation (it only records the change).
		- Fixed a typo in an operation log message (Japanese).
[EOF]