[thobed]

Summary

• Add a downloadable connectivity check script (static/files/accessanalyzer/aa26-connectivity-check.sh) that tests outbound reachability to every host the installer needs, before you even have the installer.
• Add a "Checking Connectivity Before You Install" section to requirements.md under Network > Outbound: a quick single-host curl check, running the full script, how to read its OK/FAIL/4xx-is-a-pass output, an optional LICENSE_KEY real-download test, and the proxy note.
• Add a caution note that passing LICENSE_KEY to the script exposes it in ps output to other local users, per security review feedback on this branch.
• References the upcoming sudo dspm-installer --preflight flag, which runs the same checks once the installer is downloaded.

Test plan

• vale on requirements.md — 0 errors, 0 warnings
• Doc reviewer confirms the script's host list still matches Outbound's table
• Confirm before merging whether the --preflight flag has shipped (PR update documentation for power automate #814 in access-analyzer was still open at the time of writing)

[github-actions]

Auto-Fix Summary

2 issues fixed, 4 skipped across 1 files

Category	Fixes
Dale: passive-voice	1
Dale: wordiness	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/install/requirements.md:35 — Dale: passive-voice | "the data that size is designed to hold" — every active rewrite ("that size holds", "that size supports") drops the design-target nuance, so the fix would change the meaning. |
| docs/accessanalyzer/26.1/install/requirements.md:60 — Dale: passive-voice | "Needed only when a private certificate authority (CA) issued the certificate" — "Needed" reads as a predicate adjective in a table-cell fragment (parallel to the preceding "Optional."), not a true passive construction. |
| docs/accessanalyzer/26.1/install/requirements.md:144 — Dale: passive-voice | "When it's needed" is a table column label, not prose; rewriting it would break parallelism with the other column headers. |
| docs/accessanalyzer/26.1/install/requirements.md:110 — Dale: positional-references | heading text — not modified to avoid breaking anchor links |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

2 issues fixed, 5 skipped across 1 files

Category	Fixes
Dale: passive-voice	1
Dale: positional-references	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/install/requirements.md:60 — Dale: passive-voice | "Needed only when..." is an elliptical fragment in a table cell; rewriting to a full active clause would break the terse table style used by every other cell. |
| docs/accessanalyzer/26.1/install/requirements.md:20 — Dale: idioms | "at your own risk" is a standard, literal technical disclaimer rather than a culturally specific idiom. |
| docs/accessanalyzer/26.1/install/requirements.md:58 — Dale: undefined-acronyms | PEM is a well-known certificate-encoding format for the sysadmin audience; spelling out "Privacy Enhanced Mail" would obscure rather than clarify. |
| docs/accessanalyzer/26.1/install/requirements.md:110 — Dale: positional-references | heading text — not modified to avoid breaking anchor links |
| docs/accessanalyzer/26.1/install/requirements.md:181 — Dale: wordiness | Inside a fenced bash code block (script output string); Dale rules apply to prose, and editing the script text could alter what the script prints. |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

docs/accessanalyzer/26.1/install/requirements.md

• Structure — Line 110: The new #### Checking Connectivity Before You Install subsection is inserted between the required-hosts table and the "Some features add outbound connections of their own after you configure them" paragraph and table (lines 249–258). Because the new content ends with a #### heading and the feature table has no heading of its own, the feature-specific hosts now read as part of the connectivity-check subsection — and a reader may assume the script checks them too, which it doesn't. Suggested fix: either move the #### Checking Connectivity Before You Install block below the feature table, or add a sibling heading such as #### Feature-specific hosts before line 249 and note in the new section that the script checks only the hosts in the table above.

• Structure — Line 240: "The script needs only curl. It installs nothing and changes nothing on the server." This is the prerequisite and the reassurance a reader wants before pasting and running a 100-line root-adjacent script, but it arrives two code blocks after the instruction to run it. Suggested fix: move these two sentences up to just before line 120 ("To check every host at once...") so the reader knows the requirement and the blast radius before copying the script.

• Clarity — Line 120: "For example, run vim aa26-connectivity-check.sh, press i to enter insert mode, paste the script, then press Esc and type :wq to save and exit." One sentence bundles five separate actions, and it assumes vim is installed and that the reader wants editor instructions on a requirements page. Suggested fix: "Save the script on the server as aa26-connectivity-check.sh." — or, if editor guidance is wanted, break it into numbered single-action steps per the Netwrix procedure standard.

• Clarity — Lines 120 and 123: The filename aa26-connectivity-check.sh uses the undefined shorthand aa26. Netwrix standards require spelling out abbreviations, and readers new to the product won't connect aa26 to Access Analyzer 26.1. Suggested fix: rename to access-analyzer-connectivity-check.sh throughout (heading of the <summary>, the two bash invocations, and the script's own comment block).

• Clarity — Line 181 (in the script) and line 240 (prose): The script prints "the installer honours the same variables" (British spelling) while the prose says "the installer honors the same variable" — inconsistent spelling and inconsistent singular/plural. The script also reads HTTPS_PROXY as well as https_proxy, but the prose names only https_proxy. Suggested fix: use "honors" in the script output, and change the prose to "export https_proxy or HTTPS_PROXY before you run it; the installer honors the same variables."

• Clarity — Line 238 vs. lines 185–188: The explanation that a 400, 403, or 404 response still counts as a pass appears twice — once as echo output inside the script and again in the paragraph after it. The duplication makes the section longer than it needs to be without adding information. Suggested fix: keep the prose explanation (it's better written) and trim the script's four echo lines to a single line, or vice versa.

• Completeness — Line 135 (in the script) and the surrounding prose: The script supports an optional LICENSE_KEY=xxxx mode that attempts the real installer download, and prints a "3. Real installer download with your license key" section — but the prose never mentions it. A reader who doesn't read the script source will never find the one check that actually validates their license key against the download endpoint. Suggested fix: add a sentence and example after line 236, such as: "To also confirm your license key can download the installer, pass it in: LICENSE_KEY=<license-key> bash aa26-connectivity-check.sh. An HTTP 401 or 403 from this step usually means the key is wrong or expired."

• Completeness — Line 247: "After you have the installer, sudo dspm-installer --preflight runs the same connectivity check along with the hardware, OS, and certificate checks." The --preflight flag doesn't appear in the flags table in Installer reference, which documents --dry-run and --skip-preflight but no --preflight. Suggested fix: verify the flag — if it exists, add it to the installer reference flags table; if the intended command is sudo dspm-installer --dry-run, correct it here. Also consider softening "the same connectivity check," since the script additionally covers the pre-download hosts and the optional license-key download.

• Completeness — Line 118: "If that prints BLOCKED, your network team needs to allow this connection before you can download the installer." The quick one-liner treats any HTTP response as success (same convention the script explains at line 238), but that isn't stated here, and BLOCKED gives the reader no cause to act on. Suggested fix: add one sentence — "Any HTTP response counts as reachable. If the check prints BLOCKED, run the full script below to find out whether DNS, the firewall, or TLS interception is the cause."

Summary

9 editorial suggestions across 1 file. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

1 issues fixed, 5 skipped across 1 files

Category	Fixes
Dale: passive-voice	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/install/requirements.md:33 — Dale: positional-references | "fails below them" refers to numeric values falling under a threshold, not to content elsewhere on the page. |
| docs/accessanalyzer/26.1/install/requirements.md:35 — Dale: positional-references | "below that" refers to a disk size under the 40 GB floor, not to content elsewhere on the page. |
| docs/accessanalyzer/26.1/install/requirements.md:60 — Dale: passive-voice | "Needed only when ..." is an elliptical table-cell fragment describing an optional item; rewriting it actively would change the cell's parallel structure with the other rows. |
| docs/accessanalyzer/26.1/install/requirements.md:20 — Dale: idioms | "at your own risk" is a standard, literal technical-documentation phrase rather than a culturally specific idiom. |
| docs/accessanalyzer/26.1/install/requirements.md:54 — Dale: xy-slop | "the installer never generates a certificate. You supply one." contrasts two different subjects rather than negating and restating the same one. |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

1 issues fixed, 7 skipped across 1 files

Category	Fixes
Dale: passive-voice	1

Skipped (needs manual review)	Reason

| docs/accessanalyzer/26.1/install/requirements.md:26 — Dale: passive-voice | "Designed for" is a two-word table column label; an active rewrite (for example, "Supports") would change the meaning from design target to support statement. |
| docs/accessanalyzer/26.1/install/requirements.md:60 — Dale: passive-voice | "Needed only when a private certificate authority (CA) issued the certificate" is a conventional descriptive table-cell fragment; an imperative rewrite would clash with the voice of the other cells in the Requirement column. |
| docs/accessanalyzer/26.1/install/requirements.md:20 — Dale: idioms | "at your own risk" is a standard, literal formal phrase rather than a culturally specific idiom. |
| docs/accessanalyzer/26.1/install/requirements.md:110 — Dale: positional-references | heading text — not modified to avoid breaking anchor links |
| docs/accessanalyzer/26.1/install/requirements.md:132 — Dale: passive-voice | "Nothing is installed or changed." is inside a fenced bash code block (script comment), not prose. |
| docs/accessanalyzer/26.1/install/requirements.md:188 — Dale: wordiness | Line is script output text inside a fenced bash code block, not prose. |
| docs/accessanalyzer/26.1/install/requirements.md:58 — Dale: undefined-acronyms | PEM and SMB are well-known industry standards for a sysadmin audience; spelling them out would not aid comprehension. |

Ask @claude on this PR if you'd like an explanation of any fix.