Re: EFS Recover Agents Unable to decrypt files

From: Drew Cooper [MSFT] (dcoop_at_online.microsoft.com)
Date: 06/01/04 

Date: Tue, 1 Jun 2004 14:35:37 -0700

Sorry for late reply - was out of office.

Wherever the DRA's cert was created, export the cert. In the pfx export
wizard, select "export private key". Then wherever you import the .pfx, you
should be able to decrypt the files as the DRA.
You do not need the user's private key in addition to the DRA's. 

-- 
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
"Fuente" <partagas@insightbb.com> wrote in message 
news:NBetc.30682$af3.1714525@attbi_s51...
>I don't know if this is the way it is suppose to work but I finally got a
> file decrypted by an EFS RA. This is the method I used to do it but I 
> would
> like confirmation from someone else on this.
>
> 1. The file to be decrypted was moved to the temp folder on the SAME 
> system
> the file was created on.
>
> 2. Permissions were checked to make sure that the EFS RA had full 
> permission
> to the file.
>
> 3. The EFS RA logged onto the system where the file was originally created
> as stated in step 1.
>
> 4. The EFS RA imported it's EFS RA certificate from storage in a secure
> location on a home drive
>
> 5. The EFS RA imported the users key from a secure location of the user's
> home drive.
>
> Only after both of the above certificates were imported was I successful 
> at
> decrypting the file. I tried to decrypt the file after only importing the
> EFS RA certificate but this failed.
>
> I attempted to do the same thing by copying the same file to a directory 
> on
> a server called Encryption Recovery. However, even after importing both
> certificates in steps 4 and 5, I was unsuccessful.
>
> This leads me to some serious concerns about what an EFS RA can do.
>
> 1. Why isn't the EFS RA's certificate sufficient for decryption?
>
> 2. Why couldn't the file be decrypted off of the file server even when 
> both
> certificates were imported by the EFS RA?
>
>              3. In all of the documentation I have read, nothing was ever
> mentioned about exporting the users EFS key so that it could be used for
> decryption. Why? This appears to be an integral part at recovery
>
> "Fuente" <partagas@insightbb.com> wrote in message
> news:kZGsc.111374$536.20218520@attbi_s03...
>> Thanks for responding.
>>
>> Have checked permissions as you stated many times. The account I am using
>> for decrypting the file is the original domain administrator account. The
>> only thing different is the account name has been changed. He has an EFS
> RA
>> certificate from our internal Subordinate CA. I even got another EFS RA
> just
>> to make sure.
>>
>> I don't understand what you are saying about the private key. Whose
> private
>> key? The domain admin. Isn't this what the EFS RA is for? Whenever a file
> is
>> encrypted, a special recovery key is created with the encryption process.
> Is
>> this the key you speak of? If so, where is it kept? How do you retrieve 
>> it
>> by an EFS RA?
>>
>> Maybe my assumptions are wrong in my testing process. Here is what I am
>> doing. First, I took a file by a user (which also happens to be a domain
>> admin and EFS RA) and encrypted a file. From there I simply copied the
> file
>> to a folder called EFS Recovery on a server where the domain admin has an
>> EFS RA certificate. At this point I check the properties of the file and
>> under encryption, deselect the option and click apply. This is where the
>> error message appears that I first posted.
>>
>> Shouldn't this work? Is there a different process to go about this. I 
>> have
>> applied the white papers methods of backing up the file and then 
>> restoring
>> it to the same directory and the same result happens?
>>
>> P.S. This is not a file encrypted on XP or 2003.
>>
>>
>> "Drew Cooper [MSFT]" <dcoop@online.microsoft.com> wrote in message
>> news:OeJ9X4dQEHA.3748@TK2MSFTNGP09.phx.gbl...
>> > Here are a few possibilities:
>> > - You don't have the right file permissions.  You probably already
> checked
>> > this yourself, but it's still worth mentioning.
>> > - The RA's certificate and private key aren't on the machine where
> you're
>> > trying to decrypt.
>> > - The files were encrypted on XP or 2003 and you're trying to decrypt
> them
>> > on Win2k, which doesn't understand the newer crypto algorithms.
>> >
>> > "Unknown" is displayed because of a bug in the old version of efsinfo -
>> it's
>> > trying to display information that isn't there.  It's nothing to worry
>> > about.
>> > -- 
>> > Drew Cooper [MSFT]
>> > This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>> >
>> >
>> > "Fuente" <partagas@insightbb.com> wrote in message
>> > news:cUXqc.3248$Vv.275836@attbi_s51...
>> > > Background:
>> > > Internal Certificate Service running in a 3 tier hierarchy. 
>> > > Enterprise
>> CA,
>> > > Subordinate CA, Exchange CA
>> > > Default Domain administrator and additional domain administrator have
>> > > requested and received EFS Recovery certificates and have been setup
> on
>> > the
>> > > default domain policy of Security Settings | Public Key Policies |
>> > Encrypted
>> > > Data Recovery Agents
>> > >
>> > > Created a test file on a workstation by a test account with Domain
> User
>> > > rights. Encrypted the file successfully. In order to test the ability
> of
>> > the
>> > > Recovery Agents I performed the process described in "Encrypting File
>> > System
>> > > for Windows 2000" white paper but this does not work. From the 
>> > > Windows
>> > > Explorer I get message stating ""Access is Denied" Error Message When
>> > > Encrypting or Decrypting Files or Folders". I also tried going to the
>> > users
>> > > home directory with one of the accounts and attempted to decrypt the
>> file
>> > > and this didn't work either.
>> > >
>> > > TechNet Article 264064 seemed to address the issue but after applying
>> the
>> > > solution, the problem was not resolved. (As a matter of fact, all the
>> > > "System Volume" Folders I inspected on my domain controllers has the
>> > System
>> > > account listed but none of the permission were checked except in one
>> place
>> > > where full was checked on the boot partition of on domain 
>> > > controller.)
>> > >
>> > > When I use the Efsinfo.exe utility the following results are 
>> > > displayed
>> on
>> > > the file in question:( I have changed the domain name and accounts
> from
>> to
>> > > generic names for privacy. The "Bob.Train" account is a test account.
>> > >
>> > > NOC List.txt: Encrypted
>> > >   Users who can decrypt:
>> > >     My DOMAIN\Bob.Train (CN=Bob Train)
>> > >   Recovery Agents:
>> > >     Unknown (CN=Domain Administrator)
>> > >     Unknown (CN=Default Domain Administrator)
>> > >
>> > > I am concerned about the "Unknown" entries and am wondering if this 
>> > > is
>> the
>> > > root of the problem. It doesn't appear that the Recovery Accounts are
>> > > getting the permission necessary to perform the function.
>> > >
>> > > I want to make sure that I have the ability to recover encrypted 
>> > > files
>> > > before implementing this across the board. I have search many 
>> > > articles
>> in
>> > > this forum on the subject as well as Microsoft and have yet to find a
>> > > solution. I would like any insight anyone would have in solving this.
>> > >
>> > >
>> >
>> >
>>
>>
>
>

Relevant Pages

  • RE: Relative Security Provided by Cached Domain Credentials?
    ... certificates assigned to them, with each certificate having a set number ... smart card management tools which provide private key archival for smart ... AND the cert is also valid for EFS, they likely would be able to do ... What you probably could get to work for local file encryption, ...
    (Focus-Microsoft)
  • Re: DRA is Decrypting Files when it shouldnt be!!!
    ... > EFS is allowing the RA to decrypt 200 files that were encrypted BEFORE an RA ... > encryption to get the RA to decrypt encrypted files. ... the default RA certificate was used. ... certificate and private key only when needed). ...
    (microsoft.public.windowsxp.security_admin)
  • Re: DRA is Decrypting Files when it shouldnt be!!!
    ... an administrator had taken the effort to create one and import it into Local ... >> encryption to get the RA to decrypt encrypted files. ... > When you encrypted the files, the default RA certificate was used. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: What am I doing wrong?
    ... > after I make the EFS work. ... Then I've exported my encryption certificate to a file on a diskette. ... > certificate into a file on a floppy, and I did select the "Yes, export ...
    (microsoft.public.windowsxp.security_admin)
  • Re: About EFS and local certificate that I want to export
    ... You need to get your head around how EFS works. ... EFS is local file encryption. ... the file is transferred to/from the server in the clear. ... you added the incorrect EFS certificate in step 4. ...
    (microsoft.public.windows.server.security)