To EFS or not to EFS...?

Koldov · March 25, 2019

Going through our GPOs and trying to trim them down or sort out which ones no longer apply I came across this:

After a little Googling I believe it has something to do with when you right-click on a file > Properties > Advanced > Encrypt contents to secure data

I have personally never used this option (at work or at home) so don't fully understand it's uses or implications and I do not think it is a well used/documented option anyway (certainly not within the school).

Looking at the entry it is part of the 'Default Domain Policy' that has just been replicated from the original set-up years ago, the certificate is obviously years out of date and I'm not sure how it would even work.

So the question is if/how I should delete it?

Also, once done should I set a policy to disable the option to use EFS. - I have found two potential ways to do so here:

https://www.trishtech.com/2011/05/disable-file-encryption-in-windows-7-using-group-policy/

Very similar here:

How to disable EFS using Local Group Policy in Windows Seven | IndiaWebSearch.com

This one that says it should remain enabled for servers:

https://itknowledgeexchange.techtarget.com/itanswers/how-to-prevent-users-from-using-efs-encryption-in-windows-server-2003/

and here, which shows a different option disabling it in Filesystem > NTFS:

https://www.tenforums.com/tutorials/97782-enable-disable-ntfs-file-encryption-windows.html

Finally, will any of this impact Bitlocker?