First of all, let me point out that EFS
relies on certificates for encryption, so replicating or backing up the files is useless without backing up the certificate(s) used to generate those files as well. (So, if you're not already doing so, do so.) This is presumably a large part of the reason that Microsoft's replication technologies don't support EFS
. (Encryption's interaction with bit-level changes in a file and DFS
/DFS-R
's reliance on replicating bit-level changes probably play a part too.)
You probably shouldn't be "replicating" encrypted files (in general) anyway (the use of pseudo random data in the generation of the specific encryption algorithm means you may be unable to decrpyt a simple copy anyhow), and the better approach is to decrpyt the files, then replicate or copy them, and if necessary, encrypt them fresh on the destination system.
Having said that, your best approach, if you must "replicate" EFS
encrypted files (specifically) is to use robocopy with the /EFSRAW
switch. That will allow you to copy the encrypted files over exactly, and provided you copy/backup the certificate used to generate the files as well, you'll be able to decrpyt them on the replicated system as well. I personally don't use EFS
, so I can't say if you'll be able to easily set up the EFS
certificate on the new system(s) to allow transparent access, but it seems like it should be possible. If you set up a scheduled task and script or use the /MON:n
or /MOT:t
switches with robocopy, you should be able to effectively accomplish a master-slave replication setup.