SMB file shares data classification integration
Automate data classification by integrating MineOS with your SMB file server.
Automate data classification by integrating MineOS with your SMB file server
How It Works
MineOS connects to your Windows SMB file server over your existing network and performs a statistically representative smart sample scan across your shared drives. Rather than scanning every file, MineOS:
- Classifies PII, PHI, PCI and other sensitive data found inside supported file types, producing a report of the data types discovered and the folders where they reside.
- Samples proportionally: to make the results reflect your real on-disk composition as closely as possible, the scanned sample is proportional to the on-disk file-type mix, within the constraints detailed below.
Note: This integration performs data classification only. It doesn't fulfill DSR deletion or copy requests on SMB file shares.
Before You Start
- Your SMB environment must use Active Directory/WORKGROUP with NTLM authentication.
- Create a dedicated read-only user on your file server for MineOS before setup. Reusing personal credentials isn't recommended. You'll need the server hostname, Active Directory domain, username and password to set up the integration in MineOS.
- MineOS must be able to reach your file server over the network. If your server is on a private or on-premise network, configure a VPN tunnel first. If it's publicly accessible, whitelist the MineOS IPs in your firewall.
- SMB port TCP 445 (DirectTCPTransport) must be open between MineOS and your file server.
- [Optional] Enable Preview mode to view sample PII values alongside classification results. The sample values are stored encrypted and automatically deleted after 7 days. You must enable Preview mode before running the scan to see sample values.
Setting Up
- Log in to MineOS. On the left sidebar, click Inventory → Data Sources. Click Add Data Source, search for SMB and click Add.
- Open the newly added SMB data source from the Inventory list → navigate to the Integrations tab → Request Handling section → select Integration.
- Fill in the connection fields:
- Password: the account password
- Server: server hostname or IP (for example,
fileserver01.your-company.com) - Domain: your Active Directory domain or WORKGROUP (for example,
your-company.com) - Username: the dedicated service account username
- [Optional] Share name filter: a regex; only matching share names are scanned. Leave it blank to scan all eligible shares the service account can access.
- Mark the Scan this source using Data Classifier checkbox.
- Click Test your integration to verify MineOS can connect to the file server.
- Click Test & Save.
You're done! MineOS has been connected to your SMB file server and will begin the data classification scan.
Which Shares Are Scanned
The SMB integration scans only regular, accessible shares. Administrative shares (such as C$, ADMIN$, IPC$, PRINT$) and any share whose name ends in $ are skipped automatically. This means hidden data folders named with a trailing $ (such as Finance$ or HR$) aren't scanned either. Only standard visible shares are included.
| Share example | What it is | Scanned? |
|---|---|---|
| C$, D$, E$ | Whole disk drive; Windows auto-shares one per drive for remote admin | ✗ Blocked (server admin) |
| ADMIN$ | The Windows system folder (C:\Windows), for remote management | ✗ Blocked (server admin) |
| IPC$ | Not a folder; a channel for programs to talk (named pipes / RPC) | ✗ Blocked (not a file share) |
| print$ | Shared printer driver files that client PCs download | ✗ Blocked (printer queue/$) |
| FAX$ | Working files for the Windows fax service | ✗ Blocked (name ends in $) |
| Finance$, HR$ | A normal data folder an admin hid with "$"; holds real files | ✗ Blocked (name ends in $) |
| Finance, HR, Documents | Ordinary visible folders where people keep work documents | ✓ Scanned, unless excluded by the share name filter |
| Users, home dirs | A person's private home / Documents folder | ✓ Scanned, unless excluded by the share name filter |
| smbuser (Samba phantom) | Listed as a share but won't open when connected to | Skipped gracefully |
Important: The trailing $ rule is a fallback for Samba servers that don't set the admin flag, so the scanner skips every $ share. This means legitimately hidden data folders (like Finance$ or HR$) are also skipped. If you need these folders scanned, rename the share to remove the trailing $ and make sure the service account has Read access to it.
Note: Inaccessible "phantom" shares that appear in the share list but can't be opened are skipped gracefully; the rest of the scan continues unaffected.
What MineOS Scans
MineOS scans files whose extension belongs to one of the following supported categories. All other file types are skipped.
| Category | Supported formats |
|---|---|
| Documents | .pdf, .asc, .brf, .c, .cc, .cpp, .cxx, .c++, .dart, .eml, .go, .h, .hh, .hpp, .hxx, .h++, .hs, .html, .htm, .shtml, .shtm, .xhtml, .lhs, .ini, .java, .js, .ocaml, .md, .mkd, .markdown, .m, .ml, .mli, .pl, .pm, .php, .phtml, .pht, .py, .pyw, .rb, .rbw, .rs, .rc, .scala, .sh, .sql, .tex, .txt, .text, .vcard, .vcs, .wml, .xsl, .xsd, .docx, .dotx, .docm, .dotm |
| Structured data | .avro, .csv, .tsv, .json, .xml, .yml, .yaml |
| Images (via OCR) | .bmp, .gif, .jpg, .jpeg, .jpe, .png |
| Spreadsheets | .xlsx, .xlsm, .xltx, .xltm |
| Slideshows | .pptx, .pptm, .potx, .potm |
| Parquet | .parquet |
Note: Legacy Office formats (.doc, .xls, .ppt), archives (.zip), media files (.mp4, .mp3), .odt, .rtf and other binary formats aren't supported and are skipped. Only modern Office Open XML formats are scanned.
Need Help?
If you need any help with this integration, please contact your Customer Success Manager. They will be happy to assist you!
Updated 4 days ago