Re: Enabling EFS in only one OU
From: Ryan Nordman (spacerobots_at_hotmail.com)
Date: 09/08/04
- Next message: Phillip Windell: "Re: Is there a way to deploy sp2 from a start-up script?"
- Previous message: Andrew: "Windows Messenger"
- In reply to: Dmitry Korolyov [MVP]: "Re: Enabling EFS in only one OU"
- Messages sorted by: [ date ] [ thread ]
Date: 8 Sep 2004 12:46:23 -0700
Thanks for your reply Dmitry. However I'm still finding that this
isn't working as you suggest... I've tried it in a couple test
environments I have here. It's important to note that this setting is
just a single check box for "Allow users to encrypt files using
Encrypting File System". It's either enabled or disabled, and I see
no way to set it as "not defined" unlike most GP settings. As a
result, it seems to me that when it is set to enabled, it acts more
like it is not defined, allowing lower level GPOs which have this set
to disabled to override this setting.
In my test environment, I have an OU called Mobile Computers which
contains a single GPO. I enabled EFS on that GPO. At the domain
level, I created a new GPO and set EFS to disabled. After rebooting a
machine that is in the Mobile Computers OU, I ran resultant set of
policy and found that the EFS check box is unchecked. I can confirm
that EFS is disabled on this machine because I have "encrypt the
offline folder cache" set to enabled, and I receive errors regarding
offline synchronization because it cannot encrypt the cache (when I
enable EFS again, the errors go away).
Has anybody encountered this before? It strikes me as a bug/poorly
documentent feature with the way GP works regarding this setting, but
I don't want to jump to conclusions, I could be doing something wrong
on my end. I'd be interested to know if anybody else has tried doing
this. Anyway, I'll change our group policy structure so that it is
explicitly disabled at the lowest level OUs wherever we have machine
objects which should not have EFS. It's just not the best/easiest way
to manage it.
"Dmitry Korolyov [MVP]" <d k@removethispart.mail.ru> wrote in message news:<uukQb0#jEHA.2140@TK2MSFTNGP15.phx.gbl>...
> You can disable it in a domain-wide policy, for example Default Domain
> Policy. Then you can create an additional GPO, define the setting to enable
> EFS, and link this GPO to the OU with your laptop accounts.
>
> --
> Dmitry Korolyov [d k@removethispart.mail.ru]
> MVP: Windows Server - Active Directory
- Next message: Phillip Windell: "Re: Is there a way to deploy sp2 from a start-up script?"
- Previous message: Andrew: "Windows Messenger"
- In reply to: Dmitry Korolyov [MVP]: "Re: Enabling EFS in only one OU"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
