Encrypting File System

With Encrypting File System (EFS) you can encrypt files and directories that are stored on a disk.

  • For tips about using EFS, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

Ensure files intended for encryption are created and remain encrypted

  • Encrypt folders before creating sensitive files in them for maximum security. Doing this causes the files to be created as encrypted and their data is never written to the disk as plaintext.
  • Encrypt the My Documents folder if you save most of your documents to the My Documents folder. This ensures that your personal documents are encrypted by default. For Roaming User Profiles, this should only be done when the My Documents folder is redirected to a network location.
  • Encrypt folders instead of individual files so that, if a program creates temporary files during editing, these are encrypted as well.

Manage private keys to ensure file security

  • The designated recovery agent should export the data recovery certificate and private key to disk, secure them in a safe place, and delete the data recovery private key from the system. In this way, the only person who can recover data for the system is the person who has physical access to the data recovery private key.
  • The number of designated recovery agents should be kept to a minimum. This exposes fewer keys to cryptographic attack and provides a higher level of assurance that encrypted data will not be decrypted inappropriately.
  • Use Microsoft Certificate Services to manage EFS and Data Recovery Agent (DRA) certificates and private keys.

Provide security and reliability of data at all times

  • Encrypt sensitive data on computers that are members of a domain. This protects against compromise of data though offline cryptographic attacks.
  • Use IPSec to ensure data remains encrypted as it is transmitted over the network. In addition, EFS can be used in conjunction with Web Distributed Authoring and Versioning (WebDAV) to store encrypted data on the Internet.
  • Regularly backup the entire server that stores server-based encrypted data. This ensures that in case of data recovery, the profiles that include decryption keys can be restored.

Encrypt files while System Restore is disabled

  • Disable System Restore before encrypting files that are monitored by System Restore. Once the files have been encrypted, enable System Restore. This ensures the encrypted files cannot be restored to an unencrypted state.
  • If you are encrypting file types that are monitored by System Restore, put the files on a volume that is not monitored by System Restore. For more information, see System Restore overview.


How to...

  • Encrypt or decrypt files
  • Copy or move encrypted files or folders
  • Recover files or folders
  • Allow a user to encrypt or decrypt a file


Encrypt or decrypt files

  • Encrypt a file or folder
  • Decrypt a file or folder
  • Enable a remote server for file encryption
  • Encrypt a file or folder on a remote computer


Encrypt a file or folder

Microsoft Windows graphic

To encrypt a file or folder

  1. Open Windows Explorer.
  2. Right-click the file or folder that you want to encrypt, and then click Properties.
  3. On the General tab, click Advanced.
  4. Select the Encrypt contents to secure data check box.

Notes

  • XOX
  • You can only encrypt files and folders on NTFS file system volumes.
  • Files or folders that are compressed cannot also be encrypted. If you encrypt a compressed file or folder, that file or folder will be uncompressed.
  • Files marked with the System attribute cannot be encrypted, nor can files in the systemroot directory structure.
  • When you encrypt a single file, you are asked if you want to encrypt the folder that contains it as well. If you choose to do so, all files and subfolders that are added to the folder in the future will be encrypted when they are added.
  • When you encrypt a folder, you are asked if you want all files and subfolders within the folder to be encrypted as well. If you choose to do so, all files and subfolders currently in the folder are encrypted, as well as any files and subfolders that are added to the folder in the future. If you choose to encrypt the folder only, all files and subfolders currently in the folder are not encrypted. However, any files and subfolders that are added to the folder in the future are encrypted when they are added.

Related Topics


Decrypt a file or folder

Microsoft Windows graphic

To decrypt a file or folder

  1. Open Windows Explorer.
  2. Right-click the encrypted file or folder, and then click Properties.
  3. On the General tab, click Advanced.
  4. Clear the Encrypt contents to secure data check box.

Note

  • XOX
  • When you decrypt a folder, you are asked if you want all files and subfolders within the folder to be decrypted as well. If you choose to decrypt the folder only, the encrypted files and folders within the decrypted folder remain encrypted. However, new files and folder that you create within the decrypted folder will not be automatically encrypted.

Related Topics


Enable a remote server for file encryption

Microsoft Windows graphic

To enable a remote server for file encryption

  1. Open Active Directory Users and Computers.
  2. Locate the remote server name, right-click the remote server name, and then click Properties.
  3. Select the Trust Computer for Delegation check box.

Note

  • XOX
  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • When encrypting files on a Web Distributed Authoring and Versioning (WebDAV) server, the computer does not need to be trusted for delegation.
  • You cannot configure a computer in another forest for encryption, even if there is a trust relationship established.

Related Topics


Encrypt a file or folder on a remote computer

Microsoft Windows graphic

To encrypt a file or folder on a remote computer

  1. Open Windows Explorer.
  2. On the Tools menu, click Map Network Drive, and then follow the instructions in Map Network Drive.
  3. Right-click the file or folder that you want to encrypt, and then click Properties.
  4. On the General tab, click Advanced.
  5. Select the Encrypt contents to secure data check box.

Notes

  • XOX
  • You can only encrypt files and folders on NTFS file system volumes.
  • Files or folders that are compressed cannot also be encrypted. If you encrypt a compressed file or folder, that file or folder will be uncompressed.
  • Files marked with the System attribute cannot be encrypted, nor can files in the systemroot directory structure.
  • In a domain environment, remote encryption is not enabled by default. To enable encryption for a specific computer, your network administrator can make that computer trusted for delegation. For more information, consult your network administrator.
  • When you encrypt a folder, you are asked if you want all files and subfolders within the folder to be encrypted as well. If you choose to do so, all future files and subfolders that are added to the folder are automatically encrypted.
  • Programs that create temporary work files can compromise file encryption security. When working with such programs, encrypt at the folder level rather than encrypting individual files.

Related Topics


Copy or move encrypted files or folders

  • Copy an encrypted file or folder
  • Move an encrypted file or folder


Copy an encrypted file or folder

Microsoft Windows graphic

To copy an encrypted file or folder

  1. Open Windows Explorer.
  2. Click the encrypted file or folder that you want to copy.
  3. On the Edit menu, click Copy.
  4. Open the folder or disk where you want to store the copy.
  5. On the Edit menu, click Paste.

Notes

  • XOX
  • An encrypted file or folder is decrypted if you copy it to a volume that is not an NTFS file system volume. The exception to this is when copying to a Web Distributed Authoring and Versioning (WebDAV) folder on a server.

Related Topics


Move an encrypted file or folder

Microsoft Windows graphic

To move an encrypted file or folder

  1. Open Windows Explorer.
  2. Click the encrypted file or folder that you want to move.
  3. On the Edit menu, click Cut.
  4. Open the folder where you want to move the file or folder.
  5. On the Edit menu, click Paste.

Notes

  • XOX
  • An encrypted file or folder is decrypted if you move it to a volume that is not an NTFS file system volume.

Related Topics


Recover files or folders

  • Recover an encrypted file or folder if you are a designated recovery agent
  • Recover an encrypted file or folder without your file encryption certificate
  • Back up default recovery keys to a floppy disk
  • Add a recovery agent for the local computer
  • Change the recovery policy for the local computer
  • Add a recovery agent for a domain
  • Change the recovery policy for a domain


Recover an encrypted file or folder if you are a designated recovery agent

Microsoft Windows graphic

To recover an encrypted file or folder if you are a designated recovery agent

  1. Use Backup or another backup tool to restore a user's backup version of the encrypted file or folder to the computer where your file recovery certificate and recovery key are located.
  2. Open Windows Explorer.
  3. Right-click the file or folder and then click Properties.
  4. On the General tab, click Advanced.
  5. Clear the Encrypt contents to secure data check box.
  6. Make a backup version of the decrypted file or folder and return the backup version to the user.

Notes

  • XOX
  • You can return the backup version of the decrypted file or folder to the user as an e-mail attachment, on a floppy disk, or on a network share.
  • You can also physically transport the recovery agent's private key and certificate, import the private key and certificate, decrypt the file or folder, and then delete the imported private key and certificate. This procedure exposes the private key more than the procedure above but does not require any backup or restore operations or file transportation.
  • If you are the recovery agent, use the Export command from Certificates in Microsoft Management Console (MMC) to export the file recovery certificate and private key to a floppy disk. Keep the floppy disk in a secure location. Then, if the file recovery certificate or private key on your computer is ever damaged or deleted, you can use the Import command from Certificates in MMC to replace the damaged or deleted certificate and private key with the ones you have backed up on the floppy disk.
  • For more information about using Certificates in MMC, see Related Topics.

Related Topics


Recover an encrypted file or folder without the file encryption certificate

Microsoft Windows graphic

To recover an encrypted file or folder without the file encryption certificate

  1. XOX
  2. Use Backup to make a copy of the file in case of loss or damage.
  3. Send the original encrypted file to the designated recovery agent.
  4. Have the recovery agent use their recovery certificate and private key to decrypt the file.
  5. Have the recovery agent send the decrypted file back to you, using any file transfer method that is desired.

Notes

  • XOX
  • The administrator of the local computer is the default recovery agent, unless you are in an Active Directory domain environment. In an Active Directory domain environment, the administrator that initially logged on to the first domain controller is the default recovery agent.
  • Sending the file to the designated recovery agent can be done in a number of ways, including backing up the file up to tape or floppy disk.
  • Files backed up using Backup or any other backup tool retain their encryption while in their backup storage location. The original files can be decrypted or modified without affecting the encrypted state of the backup copies.
  • You can recover an encrypted file or folder yourself if you have kept a backup copy of your file encryption certificate and private key in a .pfx file on a floppy disk. Use the import command from Certificates in Microsoft Management Console (MMC) to import the .pfx file from the floppy disk into the Personal store.
  • For more information about using Certificates in MMC, see Related Topics.

Related Topics


Back up default recovery keys to a floppy disk

Microsoft Windows graphic

To back up default recovery keys to a floppy disk

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Under Add Standalone Snap-in, click Certificates, and then click Add.
  4. Click My user account, and then click Finish.
  5. Click Close, and then click OK.
  6. Double-click Certificates - Current User, double-click Personal, and then double-click Certificates.
  7. Click the certificate that displays the words File Recovery in the Intended Purposes column.
  8. Right-click the certificate, point to All Tasks, and then click Export.
  9. Follow the instructions in the Certificate Export Wizard to export the certificate and associated private key to a .pfx file format.

Notes

  • This operation must be performed by the recovery agent account that has the recovery certificate and private key in their private store.
  • Before making any changes to the default recovery policy, be sure to secure the default recovery private key. The default recovery keys in a domain are stored on the first domain controller for the domain. The domain administrator is the default recovery agent.
  • For more information about using Certificates in MMC, see Related Topics.

Related Topics


Add a recovery agent for the local computer

Microsoft Windows graphic

To add a recovery agent for the local computer

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Under Add Standalone Snap-in, click Group Policy, and then click Add.
  4. Under Group Policy Object, make sure that Local Computer is displayed, and then click Finish.
  5. Click Close, and then click OK.
  6. On the console tree, click Public Key Policies.

    7. Where?

    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
  7. In the details pane, right-click Encrypted Data Recovery Agents.
  8. Click Add, and then follow the instructions in the Add Recovery Agent wizard.

Notes

  • XOX
  • Adding a recovery agent from a file identifies the user as USER_UNKNOWN. This is because the name is not stored in the file.
  • Before you can add or create a recovery agent, you must configure Group Policy on your computer. For more information about using Group Policy, see Related Topics.
  • In the Add Recovery Agent Wizard, be prepared to provide the wizard with the user name for a user with a published recovery certificate. Alternatively, you can use the wizard to browse for .cer files that contain information about the recovery agent you are adding.

Related Topics


Change the recovery policy for the local computer

Microsoft Windows graphic

To change the recovery policy for the local computer

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Under Add Standalone Snap-in, click Group Policy, and then click Add.
  4. Under Group Policy Object, make sure that Local Computer is displayed, click Finish
  5. Click Close, and then click OK.
  6. In Local Computer Policy, click Public Key Policies.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
  7. In the console tree, right-click Encrypted Data Recovery Agents, and then do one of the following:
    • To designate a user as an additional recovery agent using the Add Recovery Agent wizard, click Add.
    • To request a new file recovery certificate using the Certificate Request wizard, click Create. To complete this procedure, you must have the appropriate permissions to request the certificate and the certification authority (CA) must be configured to issue this type of certificate.
    • To delete this EFS policy and every recovery agent, click Delete Policy. If you select this option, users cannot encrypt files on this computer.

Important

  • Before changing the recovery policy in any way, you should first back up the recovery keys to a floppy disk.

Notes

  • XOX
  • Usually, the computer issues a default self-signed certificate that designates the initial Administrator account as the default recovery agent. However, if the user who first logs on after installation creates a second account by using the Create New User Wizard, then the second account becomes the default recovery agent.
  • If the default recovery agent's certificate is deleted without another recovery agent specified in the policy, the computer has an empty recovery policy. An empty recovery policy means that a recovery agent does not exist. This turns EFS off, so users cannot encrypt files on this computer.
  • In a domain, a default recovery policy is implemented for the domain when the first domain controller is set up. The domain administrator is issued the self-signed certificate, which designates the domain administrator as the recovery agent. To change the default recovery policy for a domain, log on to the first domain controller as an administrator.
  • To make changes to the File Recovery certificate, right-click the certificate and then clicking Properties. For example, you can use this to give the certificate a friendly name and enter a text description.

Related Topics


Add a recovery agent for a domain

Microsoft Windows graphic

To add a recovery agent for a domain

  1. Open Active Directory Users and Computers.
  2. Right-click the domain whose recovery policy you want to change, and then click Properties.
  3. Click the Group Policy tab.
  4. Right-click the recovery policy you want to change, and then click Edit.
  5. In the console tree, click Encrypted Data Recovery Agents.

    6. Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Encrypted Data Recovery Agents
  6. In the details pane, right-click, then click Add, and follow the instructions.

Notes

  • XOX
  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • This operation can be performed on any sites, domains or organizational units within an Active Directory forest.
  • Adding a recovery agent from a file identifies the user as USER_UNKNOWN. This is because the name is not stored in the file.
  • Before you can add or create a recovery agent, you must configure Group Policy on your computer. For more information about using Group Policy, see Related Topics.

Related Topics


Change the recovery policy for a domain

Microsoft Windows graphic

To change the recovery policy for a domain

  1. Open Active Directory Users and Computers.
  2. Right-click the domain whose recovery policy you want to change, and then click Properties.
  3. Click the Group Policy tab.
  4. Right-click the recovery policy you want to change, and then click Edit.
  5. In the console tree, click Encrypted Data Recovery Agents.

    6. Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Public Key Policies
    • Encrypted Data Recovery Agents
  6. In the details pane, right-click the Encrypted Data Recovery Agent and click the appropriate action you want to take.

Important

  • Before changing the recovery policy in any way, you should first back up the recovery keys to a floppy disk.

Notes

  • XOX
  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • You can right-click Encrypted Data Recovery Agents to see the changes you can make.
  • In a domain, a default recovery policy is implemented for the domain when the first domain controller is set up. The first domain administrator is issued the self-signed certificate, which designates the domain administrator as the recovery agent. To change the default recovery policy for a domain, log on to the first domain controller as an administrator.

Related Topics


Allow a user to encrypt or decrypt a file

Microsoft Windows graphic

To allow a user to encrypt or decrypt a file

  1. Open Windows Explorer.
  2. In the details pane, right-click the encrypted file that you want to change, and then click Properties.
  3. On the General tab, click Advanced.
  4. In Advanced Attributes, click Details.
  5. To allow a user to change this file, click Add, and then do one of the following:
    • To add a user whose certificate is on this computer, click the certificate, and then click OK.
    • To view a certificate on this computer before adding it to the file, click the certificate and then click View Certificate.
    • To add a user from Active Directory, click Find User, locate the user in the list, and then click OK.
  6. To remove a user's ability to change this file, click the user name and then click Remove.

Notes

  • XOX
  • You cannot add groups to file encryption access.
  • All users that are allowed to encrypt or decrypt the file must have a certificate located on the computer. For details on how to copy the certificate to the computer, see Related Topics.

Related Topics


Concepts

This section covers:

  • Encrypting File System overview
  • Using Encrypting File System


Encrypting File System overview

Encrypting File System (EFS) provides the core file encryption technology used to store encrypted files on NTFS file system volumes. Once you encrypt a file or folder, you work with the encrypted file or folder just as you do with any other files and folders.

Encryption is transparent to the user that encrypted the file. This means that you do not have to manually decrypt the encrypted file before you can use it. You can open and change the file as you normally do.

Using EFS is similar to using permissions on files and folders. Both methods can be used to restrict access to data. However, an intruder who gains unauthorized physical access to your encrypted files or folders will be prevented from reading them. If the intruder tries to open or copy your encrypted file or folder he receives an access denied message. Permissions on files and folders do not protect against unauthorized physical attacks.

You encrypt or decrypt a folder or file by setting the encryption property for folders and files just as you set any other attribute such as read-only, compressed, or hidden. If you encrypt a folder, all files and subfolders created in the encrypted folder are automatically encrypted. It is recommended that you encrypt at the folder level.

You can also encrypt or decrypt a file or folder using the cipher command. For more information see Cipher. For more information about manageability, see Management and Administration.

When you work with encrypted files and folders, keep in mind the following information:

  • Only files and folders on NTFS volumes can be encrypted. Because WebDAV works with NTFS, NTFS is required when encrypting files over WebDAV.
  • Files or folders that are compressed cannot also be encrypted. If the user marks a file or folder for encryption, that file or folder will be uncompressed.
  • Encrypted files can become decrypted if you copy or move the file to a volume that is not an NTFS volume.
  • Moving unencrypted files into an encrypted folder will automatically encrypt those files in the new folder. However, the reverse operation will not automatically decrypt files. Files must be explicitly decrypted.
  • Files marked with the System attribute cannot be encrypted, nor can files in the systemroot directory.
  • Encrypting a folder or file does not protect against deletion or listing files or directories. Anyone with the appropriate permissions can delete or list encrypted folders or files. For this reason, using EFS in combination with NTFS permissions is recommended.
  • You can encrypt or decrypt files and folders located on a remote computer that has been enabled for remote encryption. However, if you open the encrypted file over the network, the data that is transmitted over the network by this process is not encrypted. Other protocols, such as Single Socket Layer/Transport Layer Security (SSL/TLS) or Internet Protocol security (IPSec), must be used to encrypt data over the wire. WebDAV, however, is able to encrypt the file locally and transmit it in encrypted form.


Using Encrypting File System

This section covers:

  • Encrypting and decrypting data
  • Recovering data
  • Managing certificates


Encrypting and decrypting data

With Encrypting File System (EFS), you can store data securely. EFS does this by encrypting data in selected NTFS files and folders.

Because EFS is integrated with the file system, it is easy to manage, difficult to attack, and transparent to the user. This is particularly useful for securing data on computers that may be vulnerable to theft, such as mobile computers.

Files and folders cannot be encrypted or decrypted on FAT volumes. Also, EFS is designed to store data securely on local computers. As such, it does not support the secure transmission of files over a network. Other technologies, such as Internet Protocol security (IPSec), can be used in conjunction with EFS to provide an alternate solution. For more information, see Internet Protocol Security (IPSec).

Using encryption keys

Once a user has specified that a file should be encrypted, the actual process of data encryption and decryption is completely transparent to the user. The user does not need to understand this process. However, the following explanation of how data encryption and decryption works might be useful for administrators.

Encryption of files works as follows:

  • Each file has a unique file encryption key, which is later used to decrypt the file's data.
  • The file encryption key is itself encrypted; it is protected by the user's public key corresponding to the user's EFS certificate.
  • The file encryption key is also protected by the public key of each additional EFS user that has been authorized to decrypt the file and each recovery agent.

For steps on how to encrypt a file or folder, see To encrypt a file or folder

The EFS certificate and private key used can be issued by a number of sources, including automatically-generated certificates, certificates created by Microsoft certification authorities (CAs), or other CAs. For more information about certificates from other parties and EFS, see article Q273856, "Third-Party Certificate Authority Support for Encrypting File System," in the Microsoft Knowledge Base (http://www.microsoft.com/).

Decryption of files works as follows:

  • To decrypt a file, the file encryption key must first be decrypted. The file encryption key is decrypted when the user has a private key that matches the public key.
  • The original user may not be the only person that can decrypt the file encryption key. Other designated users or recovery agents can also decrypt the file encryption key by using their own private key.

For steps on how to decrypt a file or folder, see To decrypt a file or folder

Private keys are securely held in a protected key store, and not in the Security Accounts Manager (SAM) or in a separate directory.

Storing encrypted files on remote servers

If users in your Windows XP computing environment want to store encrypted files on remote servers, it is useful to know the following:

  • Windows XP supports the storage of encrypted files on remote servers.
  • Users can use EFS remotely only when both computers are members of the same Windows XP forest.
  • Encrypted data is not encrypted when in transit over the network, but only when stored on disk. The exceptions to this are when your system includes Internet Protocol security (IPSec) or Web Distributed Authoring and Versioning (WebDAV). IPSec encrypts data while it is transported over a TCP/IP network. If the file is encrypted before being copied or moved to a WebDAV folder on a server, it will remain encrypted during the transmission and while it is stored on the server.
  • Encrypted files are not accessible from Macintosh clients.
  • Storing EFS certificates and private keys on smartcards is not currently supported.
  • Strong private key protection for EFS private keys is not currently supported.

Before users can encrypt files that reside on a remote server, an administrator must designate the remote server as trusted for delegation. This allows all users with files on that server to encrypt those files. For more information, see To enable a remote server for file encryption and To encrypt a file or folder on a remote computer.


Recovering data

Data recovery is important when you need to be able to recover data encrypted by an employee after the employee leaves or when the user loses the private key. Data recovery is available through the Encrypting File System (EFS) as a part of the overall security policy for the system. For example, if you should ever lose your file encryption certificate and associated private key through disk failure, arson, or any other reason, the person who is the designated recovery agent can recover the data. In a business environment, an organization can recover data encrypted by an employee after the employee leaves.

Recovery policy

EFS uses recovery policies to provide built-in data recovery. A recovery policy is a type of public key policy that provides for one or more user accounts to be designated as recovery agents.

A recovery policy is configured locally for stand-alone computers. For computers that are part of a network, a recovery policy is configured at the domain, organizational unit, or individual computer level and applies to all Windows XP-based computers that the policy applies to. A certification authority (CA) issues recovery certificates and you use the Certificates snap-in to manage them.

In a domain, Windows XP implements a default recovery policy for the domain when the first domain controller is set up. The domain administrator is issued the self-signed certificate, which designates the domain administrator as the recovery agent. To change the default recovery policy for a domain, log on to the first domain controller as an administrator. Additional recovery agents can be added to this policy and the original recovery agent can be removed at any time.

Because the Windows XP security subsystem handles enforcing, replicating, and caching of the recovery policy, users can implement file encryption on a system that is temporarily offline, such as a portable computer. This process is similar to logging on to their domain account using cached credentials. For more information, see To change the recovery policy for the local computer and To change the recovery policy for a domain.

Recovery agents

A recovery agent is an individual who is authorized to decrypt data that was encrypted by another user. Recovery agents do not need any other permissions to function in this role. Recovery agents are useful, for example, when employees leave the company and their remaining data needs to be decrypted. Before you can add a recovery agent for a domain, you must ensure that each recovery agent has been issued an X.509v3 certificate.

Each recovery agent has a special certificate and associated private key that allows data recovery wherever the recovery policy applies. If you are the recovery agent, you should be sure to use the Export command in the Certificates snap-in in Microsoft Management Console (MMC) to back up the recovery certificate and the associated private key and store it in a secure location. After backing them up, you should use Certificates to delete the recovery certificate. Then, when you need to perform a recovery operation for a user, you should first restore the recovery certificate and associated private key using the Import command in Certificates. After recovering the data, you should again delete the recovery certificate. You do not have to repeat the export process.

To add recovery agents for a domain, you add their certificates to the existing recovery policy. For steps on how to add recovery agents to a domain, see To add a recovery agent for a domain.

Recovery agent information that has been added and removed is not automatically updated on existing EFS files. The information in these files is updated the next time the file is accessed. New files always use the current recovery agent information.


Managing certificates

Encrypting File System (EFS) uses public key cryptography to encrypt the contents of files. It uses keys that are obtained from the certificate of the user and any additional users and designated recovery agents that are configured. Because the certificates may also contain private key information, they must be managed correctly.

The certificate and private key of all designated recovery agents should be exported to a removable disk and stored securely until needed. For more information, see To export a certificate with the private key. When exporting the certificate and private key, ensure that the selected certificate includes Encrypting File System in its intended purposes and that you have the associated private key. You can view the intended purposes of a certificate by using the Certificates snap-in.

Certificates and private keys can be used on multiple computers. If your Windows XP network uses roaming profiles, the certificates will be available on any computer you log on to. Otherwise, the certificates and private keys must be exported and imported manually. To manually export a certificate and private key, use the procedure that was previously mentioned here. To import the information, see To import a certificate.


Troubleshooting

What problem are you having?

The Advanced button is unavailable.

Cause: Encrypting File System (EFS) only works on files and folders on NTFS file system volumes. If the folder or file you are trying to encrypt is on a FAT or FAT32 volume, the Advanced button does not appear in the properties of that folder or file.

Solution:

  • Convert the volume to NTFS with the convert utility.
    1. Open Command Prompt.
    2. Type:
      convert drive /fs:ntfs
      where drive is the drive letter of the intended drive.

See also: convert.

The "Recovery policy configured for this system contains invalid recovery certificate" or "ERROR_BAD_RECOVERY_POLICY" message appears when encrypting a file.

Cause: The Encrypting File System (EFS) recovery policy implemented on this computer contains one or more EFS recovery agent certificates that have expired. These certificates cannot be used.

Solution:

  • Either renew the existing certificates or generate new certificates for the EFS recovery agents and reapply the recovery agent policy with those certificates.

See also: Requesting certificates or Renewing certificates.

The "Access denied" message appears when opening an encrypted file.

Cause: The file was encrypted by Encrypting File System (EFS) using a public key certificate and the associated private key for this certificate is not available on this computer.

Solution:

  • Locate the private key for the appropriate certificate and import it onto this computer using the Certificates snap-in.

See also: To import a certificate and "Encrypting File System" at the Microsoft Resource Kits Web site.(http://www.microsoft.com/)

The "Key not valid for use in specified state" message appears when encrypting a file on a remote computer.

Cause: Both computers must reside in the same Active Directory domain to use Encrypting File System (EFS) on remote shares. The remote computer must also be trusted for delegation in the Active Directory.

Solution:

  • Join both computers to the same Active Directory domain and trust the remote computer for delegation.

See also: To join a domain and To designate a remote server for file encryption.


Storing Data Securely

Stored data security refers to the ability to store data on disk in an encrypted form. By using Encrypting File System (EFS), users can encrypt their data as it is stored on disk.

To help you administer EFS, it is recommended that you read the following topics.

  • Introduction to using Encrypting File System
  • Encrypting and decrypting data using Encrypting File System
  • Backing up, restoring, and recovering data


Introduction to using Encrypting File System

Encrypting File System (EFS) allows users to store their on-disk data in encrypted format.

Encryption is the process of converting data into a format that cannot be read by another user. Once a user has encrypted a file, the file automatically remains encrypted whenever the file is stored on disk.

Decryption is the process of converting data from encrypted format back to its original format. Once a user has decrypted a file, the file remains decrypted whenever the file is stored on disk.

EFS provides the following features:

  • Users can encrypt their files when storing them on disk. Encryption is as easy as selecting a check box in the file's Properties dialog box.
  • Accessing encrypted files is fast and easy. Users see their data in plain text when accessing the data from disk.
  • Encryption of data is accomplished automatically, and is completely transparent to the user.
  • Users can actively decrypt a file by clearing the Encryption check box on the file's Properties dialog box.
  • Administrators can recover data that was encrypted by another user. This ensures that data is accessible if the user that encrypted the data is no longer available or has lost their private key.

EFS only encrypts data when it is stored on disk. To encrypt data as it is transported over a TCP/IP network, two optional features are available--Internet Protocol security (IPSec) and PPTP encryption.


Encrypting and decrypting data with Encrypting File System

You can use Encrypting File System (EFS) to:

  • Encrypt data
  • Access encrypted data
  • Copy, move or rename encrypted data
  • Decrypt data

Encrypting data

The default configuration of the Encrypting File System (EFS) requires no administrative effort--users can begin encrypting files immediately. EFS automatically generates an encryption key pair for a user if one does not exist.

EFS can use either the expanded Data Encryption Standard (DESX) or Triple-DES (3DES) as the encryption algorithm.

Encryption services are available from Windows Explorer. Users can also encrypt a file or folder using the command-line function cipher. For more information about the cipher command, type cipher /? at a command-line prompt.

Users encrypt a file or folder by setting the encryption property for files and folders just as you set any other attribute, such as read-only, compressed, or hidden. If a user encrypts a folder, all files and subfolders created in or added to the encrypted folder are automatically encrypted. It is recommended that users encrypt at the folder level.

Files or folders that are compressed cannot also be encrypted. If the user marks a compressed file or folder for encryption, that file or folder will be uncompressed. Also, folders that are marked for encryption are not actually encrypted. Only the files within the folder are encrypted, as well as any new files created or moved into the folder.

Accessing encrypted data

Users access encrypted files just as they do unencrypted files. Thus, when a user accesses an encrypted file that is stored on disk, the user is able to read the contents of the file in the normal way. When the user stores the file on disk again, EFS transparently encrypts the file again.

Copying, moving or renaming encrypted data

Copying or moving unencrypted files into an encrypted folder will automatically encrypt those files in the new folder. However, the reverse operation will not automatically decrypt files. Files retain their encrypted property until explicitly decrypted or moved to a non-NTFS volume. Similarly, renaming an encrypted file does not alter its encrypted status.

Decrypting data

You can decrypt a file by clearing the Encryption check box in a the file's Properties dialog box. Once decrypted, the file remains decrypted until you encrypt the file again. There is no automatic re-encryption of a file, even if it exists in a directory marked as encrypted.

Users can decrypt a file by either clearing the Encryption check box on the file's Properties dialog box, or using the cipher command.


Backing up and recovering encrypted data

The main administrative tasks associated with the Encrypting File System (EFS) are backing up and restoring encrypted files, configuring a recovery policy, and recovering encrypted data.

Backing up and restoring encrypted files

Backup copies of encrypted files will also be encrypted, provided you use a backup program designed for Windows XP.

When restoring encrypted data, the data will remain encrypted after the restore operation.

Recovering encrypted data

Data recovery refers to the process of decrypting a file without having the private key of the user who encrypted the file.

You might need to recover data with a recovery agent if:

  • A user leaves the company.
  • A user loses the private key.
  • A law enforcement agency makes a request.

To recover a file, the recovery agent:

  1. Backs up the encrypted files.
  2. Moves the backup copies to a secure system.
  3. Imports their recovery certificate and private key on that system.
  4. Restores the backup files.
  5. Decrypts the files, using Windows Explorer or the EFS cipher command.

Configuring a recovery policy

You can use the Group Policy snap-in to define a data recovery policy for domain member servers or for stand-alone or workgroup servers. You can either request a recovery certificate, or export and import your recovery certificates.

You may want to delegate administration of the recovery policy to a designated administrator. Although you should limit who is authorized to recover encrypted data, allowing multiple administrators to act as recovery agents provides you with an alternate source if recovery is necessary.