2

Recently I attempted to configure Microsoft's DFSR on Windows 2008 R2 to replicate a folder which was encrypted with EFS. The setup gave no errors or warnings, but later I read that DFSR does not support EFS in any way. There were also event logs in the DFSR event log indicating an encrypted file was found and wont be replicated.

http://technet.microsoft.com/en-us/library/cc773238(v=ws.10).aspx#BKMK_052

My question is, are there any tools that would allow this to occur? Software based preferably.This would be replicating over LAN to destination node for two servers on the same domain.

1 Answer 1

3

First of all, let me point out that EFS relies on certificates for encryption, so replicating or backing up the files is useless without backing up the certificate(s) used to generate those files as well. (So, if you're not already doing so, do so.) This is presumably a large part of the reason that Microsoft's replication technologies don't support EFS. (Encryption's interaction with bit-level changes in a file and DFS/DFS-R's reliance on replicating bit-level changes probably play a part too.)

You probably shouldn't be "replicating" encrypted files (in general) anyway (the use of pseudo random data in the generation of the specific encryption algorithm means you may be unable to decrpyt a simple copy anyhow), and the better approach is to decrpyt the files, then replicate or copy them, and if necessary, encrypt them fresh on the destination system.

Having said that, your best approach, if you must "replicate" EFS encrypted files (specifically) is to use robocopy with the /EFSRAW switch. That will allow you to copy the encrypted files over exactly, and provided you copy/backup the certificate used to generate the files as well, you'll be able to decrpyt them on the replicated system as well. I personally don't use EFS, so I can't say if you'll be able to easily set up the EFS certificate on the new system(s) to allow transparent access, but it seems like it should be possible. If you set up a scheduled task and script or use the /MON:n or /MOT:t switches with robocopy, you should be able to effectively accomplish a master-slave replication setup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .