Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can I encrypt shared files on windows server and allow only authenticated domain users have access to these files?

The scenario as follows:

I have a software development company, and I would like to protect my source code from being copied by my programmers.

One problem is that some programmers use their own laptops to developing the company's software.

In this scenario it's impossible to prevent developers from copying the source code for their laptops.

In this case I thought about the following solution, but i don't know if it's possible to implement.

The idea is to encrypt the source code and they are accessible (decrypted) only when developers are logged into the AD domain, ie if they are not logged into the AD domain, the source code would be encrypted be useless.

Can be implemented this ? What technology should be used?

share|improve this question

2 Answers 2

EFS is the technology to use, but there is nothing to stop users copying the decrypted source to another location. You also have a problem if users are using their 'own' laptops, because then if you do join these computers to the domain, they'll have cached credentials of AD & can login as AD users outside the office, in which case you disable that too??

Best bet is to stop developers using their own laptops & prevent them from plugging in portable storage devices to desktops in the office.

You'll need to setup an Enterprise CA & possibly autoenrollment.

share|improve this answer

I did some tests using EFS and AD domain. I think the following solution can be used.

I used EFS to encrypt a folder and gave permission to a user X. When this user login with domain credentials have full access to this folder and can copy all files. (encrypted files!)

But if the user doesn't login with the credentials of the AD domain, they cannot access the files. Even if he is using the local administrator account on the machine.

The problem now is that AD remains cached user information.

Now I need to know if you can configure the AD to authenticate that the laptops only if the server is online and do not let these users to decrypt the files using EFS.

Have you already implemented something like this?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.