My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so forth. So, EFS works. However, he also wants the user to be prompted for their certificate password (the password generated when you first create the certificate) when:
- The user first logs in/accesses an encrypted file
- After a periodic time out when they go to access the file.
- If the user locks their screen.
I've configured a group policy to clear the cache every 240 minutes and when they lock their screen. I've also set the local machine registry and domain GP to require strong protection of private keys. However, it doesn't really seem to do what he's looking for. Is what he wants possible without using a second form of authentication (smart card, etc). If so, where am I messing up?