Tag Info

Hot answers tagged

7

Your first problem is you have an administrator that you don't trust. This is a human resources issue, and you may need to take it up as such. Second, you could only "protect" them by placing the files in a volume that's encrypted separate from Windows (encapsulating the data). There are methods to do this and products to do so if you google for it. BUT ...


5

No. EFS encryption doesn't occur at the application level but rather at the file-system level; therefore, the encryption and decryption process is transparent to the user and to the application. If a folder is marked for encryption, every file created in or moved to the folder will be encrypted. Applications don't have to understand EFS or manage ...


4

You must export the EFS private key from the first machine using certmgr.msc and import it to the second machine. Only then you will be able to decrypt files. (Passwords and anything else do not matter.) But having two EFS private keys on one machine can really confuse both the user and the OS... A better solution would be to use full-drive encryption ...


3

After setting up a test VM environment, I determined the following. To view EFS encrypted files, YOUR personal EFS store must contain the PRIVATE key of the certificate created by the user who encrypted the file, OR the private key of the Recovery Agent certificate. You cannot import the private key into the machine's certificate store as this only gives ...


3

It is possible to give multiple users access to an EFS encrypted file, so long as you are using windows XP or above on clients, and server 2003 or above on the server. You cannot do it for a group, you will need to add each individual user. The main point to be aware of with this is that the user(s) you want to give access to the EFS encrypted file must ...


2

I'd setup File Monitor with a suitable filter and leave it running. Or have it triggered by Performance Monitor. Certainly leave Perfmon running to see the time as this might give an indication of a cronjob running at the same time etc..


2

At first I thought that you would want to create a Domain Recovery Agent. Then I was reminded that, (and I cannot confirm this), I believe that a DRA is only good for recovering encrypted files that were encrypted after the agent was created. Also, revoking the certificate might complicate matters some. Nonetheless, consider what you can do with the Domain ...


2

I'm reasonably certain that Samba4 does not support hosting the Encrypting File System. None of the changelogs since Samba 3.0 mention it as a feature, and the Samba 3 page itself shows it as a feature they'd like to have since Microsoft released details about how it works; which is different than a feature they actually have.


2

First of all, let me point out that EFS relies on certificates for encryption, so replicating or backing up the files is useless without backing up the certificate(s) used to generate those files as well. (So, if you're not already doing so, do so.) This is presumably a large part of the reason that Microsoft's replication technologies don't support EFS. ...


2

Nothing would prevent the admin to install keyloggers etc., and you wouldn't even notice, so: No, your assumptions are wrong.


1

It is not possible via built-in mechanisms. A bit of theory: private key strong protection prompts for input only when private key material is accessed. A bit of practice: when you encrypt/decrypt files on remote share, remote certificate is used to perform these operations. That is, EFS loads user profile on a file share hosting server, loads the ...


1

The point of EFS is that decryption must be deliberate. If you try and copy an EFS encrypted file to a different computer that doesn't support EFS, then you will get a warning. Ideally, this is a training issue. Teach your users how to decrypt their files.


1

I found an acceptable alternate solution with Symantec PGP File Share Encryption. With this, you can select various network path and specify that files in that folder should be encrypted and you can give various PGP keys. When you put files there, they get encrypted. When you pull files out of there, they are decrypted.


1

Well I can't quantify exactly how much of a performance impact you would feel. There would be some. But the point is, if you're required to encrypt this data then that is what you have to do, and you just have to bite the bullet on any potential performance impact. Have you considered that, once a client accesses an EFS-encrypted file on an SMB network ...


1

I can't believe this answer has been up-voted, with out anyone correcting it. YES. EFS on Server 2008 R2 supports multiple users accessing an encrypted file. http://windowsitpro.com/security/efs-and-encrypted-file-sharing


1

According to Microsoft Support, this is a bug. When using Windows Encrypted File System with modern Office documents and multiple users (certificates) the additional user-certificates are lost after the file has been edited. The problem still exists on Windows 8 with Office 2013 It may be a conceptual problem and I don't know whether it will or can be ...


1

An "untrusted" administrator should be getting his rights revoked. There are tons of other ways to steal data if you have full rights on a server.


1

I'm not exactly sure what is preventing the the DRA from being set on the file, but here is a breakdown of the EFS GPOs I have which may help you verify all the components are in place. Getting EFS set up is a pretty complex patchwork of components if you ask me. Computer GPO for Recovery Policy. It sounds like you have this setup correctly with the ...


1

EFS doesn't support remote decryption except in a domain. "Remote EFS operations on files stored on network file shares are possible in Windows 2000 or later domain environments only." - Using Encrypting File System In any event, it couldn't work the way you're trying to make it work. EFS has no encrypted wire protocol. The way it would have to work is ...


1

Yes, alternately, use cipher.exe: cipher.exe /h /s:c:\


1

Further research revealed that the EFS certificates will continue to read any encrypted files as long as the user has the cert... even if the certificates are revoked and the CA is decommissioned. What the users cannot do after the certs are revoked is (re-)encrypt any files... which we don't want them to do anyway. So thus I didn't have to use CRL signing ...


1

I think using public key cryptography would be a good fit for this. Generate the secret, then encrypt it with the public key. Save it locally. Share it everywhere for all anyone cares. Provided your initial encryption is good enough, there is no issue with local administrators having access to the encrypted secret. This assumes of course you do not ...


1

Chkdsk showing anything? Executing a delete command from cmd.com shell doesn't do anything either? What about mounting the share from a Linux system and then sudo rm filename from that? still fail? I'd be really tempted if the filesystem check isn't fixing it to try booting with a Linux liveCD and mounting the NTFS drive and trying to delete the file from ...


1

Sounds like file system corruption; run chksdk and see what it reports. EFS should not prevent you from deleting files, just reading them.


1

Have you tried to unencrypt these files? You can also use the efsinfo command from the Resource kit to get more information about the files. Cipher /d /a Efs###.tmp


1

The dell dimension A07 bios does support legacy usb iirc. I think the problem might be windows, rather than anything else: I've had this problem a couple of times on Dell boxes running windows XP. 1) install windows XP and everything is happy. 2) shut down the box, change usb keyboard/mouse, switch back on. 3) Computer refuses to see the keyboard and ...


1

If you setup recover agents in group policy, you should be able to install the recovery agent's private key onto the new machine and decrypt the files when logged in as that user. Also another option would be to see if you can export the users private key from the CA or if it has already been exported somewhere else and install this key for the user. If ...


1

Has anyone else been tasked with a similar request, and if so, how did you deal with it? If they don't want the sysadmins to have access, it doesn't truly matter if you use EFS or NTFS permissions - the short answer is that if you want the data to be backed up, admins need access. It's impossible to have access to what you can't read - so if they're ...



Only top voted, non community-wiki answers of a minimum length are eligible