File Encryption

Secure Home | Search | About

Lost Password?

Microsoft Applications Security

get this group's latest topics as an RSS feed

add this group's latest topics to your My MSN content

add this group's latest topics to your My Yahoo content

add this group's latest topics to your Google content

Subject

Author

Date

File Encryption

Scott

02-17-2006

Cra

Byron Hynes [MS...

Roger Abell [MV...

Posted by =?Utf-8?B?U2NvdHQ=?= on February 17, 2006, 2:42 pm

If you were Registered and logged in, you could reply and use other advanced thread options

Hello,

I am not able to open a file that I encrypted. Here are the details:

I encrypted a file on a USB drive (NTFS) while logged on as the domain
administrator of a Win2003 domain controller. I exported the administrator’s
EFS certificate to the same USB drive. I moved the USB drive to a WinXP PC,
which is logged in as a user of a different domain. I imported the
certificate and was able to open the file successfully. Perfect! However,
this suddenly turned out to be the ONLY user that could open this file.

I moved the USB drive back to the original domain controller and the
administrator could no longer open the file, no matter what I tried. Nor
could I open the file if I moved the USB drive to a 3rd WinXP PC that is
logged in as a different user (even after importing the EFS certificate).
Why this strange behavior?

I would expect that any user could open the file once I imported the EFS
certificate, but this is not the case.

I noticed the user listed under “Users who can transparently access this
file” changed after I did the certificate import and opened the file on the
WinXP PC. It changed from the domain administrator to the WinXP user of the
different domain. I simply can’t get it to change back to the domain
administrator (or any other user).

How do I get the domain administrator (or any other user) to open this file?

Thanks,
Scott

Posted by =?Utf-8?B?Q3Jhbmt5SUVVc2Vy?= on February 17, 2006, 3:55 pm

If you were Registered and logged in, you could reply and use other advanced thread options

You need to find out which certificate is able to decrypt the file. Run the
resource kit utility efsinfo.exe as:

efsinfo /u /r <filename>

C:\tmp>efsinfo /u /r new.bmp

new.bmp: Encrypted
Users who can decrypt:
CTS\joe.smoe (Joe Smoe(joe.smoe@contrails.com))
Recovery Agents:
Unknown (Chuck Whitmarsh(admin.whitmarsh@contrails.com))

This will show you the recovery agent. If you have the correct recovery
agent key as indicated in the output your good to go...

Cr

"Scott" wrote:

> Hello,

> I am not able to open a file that I encrypted. Here are the details:

> I encrypted a file on a USB drive (NTFS) while logged on as the domain

> administrator of a Win2003 domain controller. I exported the

administrator’s

> EFS certificate to the same USB drive. I moved the USB drive to a WinXP PC,

> which is logged in as a user of a different domain. I imported the

> certificate and was able to open the file successfully. Perfect! However,

> this suddenly turned out to be the ONLY user that could open this file.

> I moved the USB drive back to the original domain controller and the

> administrator could no longer open the file, no matter what I tried. Nor

> could I open the file if I moved the USB drive to a 3rd WinXP PC that is

> logged in as a different user (even after importing the EFS certificate).

> Why this strange behavior?

> I would expect that any user could open the file once I imported the EFS

> certificate, but this is not the case.

> I noticed the user listed under “Users who can transparently access this

> file” changed after I did the certificate import and opened the file on the

> WinXP PC. It changed from the domain administrator to the WinXP user of the

> different domain. I simply can’t get it to change back to the domain

> administrator (or any other user).

> How do I get the domain administrator (or any other user) to open this file?

> Thanks,

> Scott

Posted by Byron Hynes [MS] on February 19, 2006, 12:26 am

If you were Registered and logged in, you could reply and use other advanced thread options

When using EFS on removable devices, you must be absolutely certain that
the device is dis-mounted properly each and every time. Can you be sure that
no-one ever removed the USB drive without using "safely remove hardware"
first? The file may acctually have become corrupted.

Byron Hynes
Windows Server
Microsoft Corporation

http://spaces.msn.com/members/byronphynes

> Hello,

> I am not able to open a file that I encrypted. Here are the details:

> I encrypted a file on a USB drive (NTFS) while logged on as the domain

> administrator of a Win2003 domain controller. I exported the

> administrator’s EFS certificate to the same USB drive. I moved the

> USB drive to a WinXP PC, which is logged in as a user of a different

> domain. I imported the certificate and was able to open the file

> successfully. Perfect! However, this suddenly turned out to be the

> ONLY user that could open this file.

> I moved the USB drive back to the original domain controller and the

> administrator could no longer open the file, no matter what I tried.

> Nor could I open the file if I moved the USB drive to a 3rd WinXP PC

> that is logged in as a different user (even after importing the EFS

> certificate). Why this strange behavior?

> I would expect that any user could open the file once I imported the

> EFS certificate, but this is not the case.

> I noticed the user listed under “Users who can transparently access

> this file” changed after I did the certificate import and opened the

> file on the WinXP PC. It changed from the domain administrator to the

> WinXP user of the different domain. I simply can’t get it to change

> back to the domain administrator (or any other user).

> How do I get the domain administrator (or any other user) to open this

> file?

> Thanks,

> Scott

Posted by Roger Abell [MVP] on February 19, 2006, 5:46 pm

If you were Registered and logged in, you could reply and use other advanced thread options

After you imported the cert and then opened the previously EFS
encrypted file, did you do this in an account that already had an
EFS cert ? That is, is it possible the account had two cert/keys
for EFS after you did the import, and then when you closed the
file it was reencrypted with the account's main EFS cert?
You could look at tht thumbprint of the file and certs to tell.

> Hello,

> I am not able to open a file that I encrypted. Here are the details:

> I encrypted a file on a USB drive (NTFS) while logged on as the domain

> administrator of a Win2003 domain controller. I exported the

> administrator's

> EFS certificate to the same USB drive. I moved the USB drive to a WinXP

> PC,

> which is logged in as a user of a different domain. I imported the

> certificate and was able to open the file successfully. Perfect!

> However,

> this suddenly turned out to be the ONLY user that could open this file.

> I moved the USB drive back to the original domain controller and the

> administrator could no longer open the file, no matter what I tried. Nor

> could I open the file if I moved the USB drive to a 3rd WinXP PC that is

> logged in as a different user (even after importing the EFS certificate).

> Why this strange behavior?

> I would expect that any user could open the file once I imported the EFS

> certificate, but this is not the case.

> I noticed the user listed under "Users who can transparently access this

> file" changed after I did the certificate import and opened the file on

> the

> WinXP PC. It changed from the domain administrator to the WinXP user of

> the

> different domain. I simply can't get it to change back to the domain

> administrator (or any other user).

> How do I get the domain administrator (or any other user) to open this

> file?

> Thanks,

> Scott

Similar Threads	Posted
File encryption problem	July 17, 2007, 4:22 pm
Re: File/Folder encryption - Compliancy with PCI	November 24, 2005, 11:21 am
File/Folder encryption - Compliancy with PCI	September 28, 2005, 5:31 am
Reasons TO use full HHD encryption vs File/Folder (non-EFS)	September 21, 2005, 5:04 am
Need Help Disabling WinXP EFS Encryption for Outlook File Attachments	May 27, 2006, 2:26 pm
Data Encryption Standard (DES) encryption	November 15, 2005, 6:26 pm
portably encrypting a file system's partition, directory and/or file	November 25, 2005, 3:30 pm
hosts file references to another "master" host file	November 21, 2006, 5:34 pm
Execute File Auditing on a File Share	April 25, 2007, 11:46 pm
Encryption	July 13, 2005, 5:32 pm

The site map in XML format XML site map