Fun with EFS

[RobC]

Ok, has anyone ever had to recover files encrypted using 2k3/XP's Encrypted File System? One of our office staff decided to encrypt an archive of files held on the Staff Shared drive when she started last year. Unfortunately her profile appears to have lost the EFS key and she now can't access these files. And neither can I.

 

Anyone got any ideas?

[russdev]

just seen this while looking for something else

 

http://tcpmag.com/forums/forum_posts.asp?tid=1646&pn=1&Tpn=1

 

Russ

[RobC]

Oh well, she's buggered then. The linked post gave a link to a KB article which basically said that if you do not have a backup of the user's EFS Key or the DRA's EFS Key then ur up Faeces Creek with out a paddle.

 

And I can't locate either key where they should be.

 

 

That'll teach her not to encrypt things without asking the Admins. :twisted:

[MkII]

Researching AUP's and the "law" it says that if anyone encrypts data on your network they have to give the administrator that password. And it's said like that should be stated in the AUP too.

[ajbritton]

I'm no expert, but I thought that the Domain Administrator is, by default, the DRA??

[RobC]

Yep AJB, that Domain Admin is indeed the DRA, but that account can't access the files either. I can't find a certificate in either account.

[Geoff]

You need to make a secondary certificate assigned to the domain admin (or some other sensible account) that can decrypt the EFS files. I'm sure I've seen a MS whitepaper or some such on the matter.

 

Ah, here we are:

 

http://www.microsoft.com/technet/prodtechnol/winxppro/support/dataprot.mspx