Re: Event ID 6032

And no WebDAV share on the SBS partition that houses the My Docs folder,
right...

"Administrators and users should take care to not encrypt files locally on a
volume that hosts a WebDAV share or to set the encryption attribute locally.
All administration should be through the WebDAV share only. It is also
important to note that if a user does not have a key to decrypt the file on
a WebDAV share, the user will not be able to specify the advanced EFS
details of the file, such as the users that are allowed to decrypt the file.
The user will instead get an "access denied" error. "

OR a user password recently changed remotely...

"A common issue with domain-based accounts may occur when changing a user
password over RAS (dial-up or VPN). In this case, the user password is
changed with the domain controller and the DPAPI master key updated, however
it will not be replicated immediately. When users disconnect and attempt to
access locally encrypted files, they may receive an "Access Denied" error
message. To resolve this issue, the user may connect to the network normally
and log on to update the DPAPI master key, or to set the following registry
DWORD value in the registry: "

--
Merv Porter [SBS-MVP]
============================
"Ian" <Ian@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:8CD87BF3-E6CE-437D-838B-9403D4A70097@xxxxxxxxxxxxxxxx
Dave -

This is what has me stumped as well. I have done what you said with no
luck. Its really weird.

I made sure I have the recovery agent "Administrator" certificate
installed
as well and I do.

I went to Domain Contrller Security Settings -> Public Key Policies - >
Encrypted File System and the correct recovery key is in there.

I can NOT read, copy or move any of the encrypted files either. All I get
is Access Denied.

I have tried taking ownership as well.





"Dave Nickason [SBS MVP]" wrote:

EFS doesn't care who owns the files. They can only be decrypted by the
person who encrypted them, or by the designated "recovery agent." You
can
see who is the recovery agent by opening the properties of an encrypted
file
(not folder). On the General tab, click Advanced, then Details. That
said,
by default the Administrator account should be the recovery agent.
However,
you should look at the properties of one of the files to be sure.

I'm not clear on what's happening here. You'd normally be able to just
decrypt the files by reversing the process in which you encrypted them.
If
you brought up the properties of the My Documents folder and clicked the
box
to encrypt, you should just be able to un-click the box to decrypt. Or,
if
the files are stored on the server, the Administrator should be able to
decrypt them.

If the files are stored on the workstation, you can log in as
Administrator
and import the recovery agent certificate from the server. Or better
than
have that certificate on a workstation, back up the files and restore
them
on the server. Either way, if Administrator is the recovery agent, that
account should be able to decrypt the files. Then replace the encrypted
versions with the decrypted ones.

Can you read the files normally?


"Ian" <Ian@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:DC58607C-B9C6-4F53-9A92-DDCA0F8A35B6@xxxxxxxxxxxxxxxx
I have tried that....

This is what has me stumped. I have taken ownership via Administrator
and
still nothing.

I would be happy to give you access to have you try yourself.




"Merv Porter [SBS-MVP]" wrote:

What happens if you log as as a domain administrator and "take
ownership"
of
the specific My Doc folder on the server and then try to decyrpt?

--
Merv Porter [SBS-MVP]
============================

"Ian" <Ian@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:21F227B2-A8E3-42D2-9971-5AB7FD88E51E@xxxxxxxxxxxxxxxx
I think... what its referring to is that they way I have the "My
Docuents"
folder mapped.

I mapped it like this instead of allowing SBS to do it .
"\\SERVER\Users\username\My Documents"


I have tried restoring it directly from the server under
Administrator
and
it gives me the same error.




"Ian" wrote:

I made the mistake of Encrypting my My Documents folder on my
Windows
XP
SP1
Workstation. Now when I try to Decrypt the files I get Access
Denied.

The following error is returned on my SBS 2003 Pre SP1 Event Logs.

Can anyone help?


Event Type: Error
Event Source: EFS
Event Category: None
Event ID: 6032
Date: 4/19/2007
Time: 2:37:10 PM
User: N/A
Computer: SERVER
Description:
EFS does not support encryption over network sessions established
using
the
NTLM protocol.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0b 00 09 80 ...?









.

Relevant Pages

  • EFS data recovery - handholding needed
    ... recovery agent in XP as XP eliminated the default recovery ... What i found is that if i created a folder & encrypt its ... NTFS permission to the administrator, even if i log in as ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Encrypting a folder and all its contents.
    ... A particular folder that I can encrypt, ... First, I created a new folder, named it "TestEncrypt", ... "Decrypt a file or folder", ...
    (microsoft.public.windowsxp.general)
  • Re: Remove domain user ability to encrypt files
    ... designation the "domain" administrator as the recovery agent for all domain ... administrator can do with it what he/she pleases. ... > only have permissions to save documents in their My Documents folder. ... But we don't want users to be able to encrypt their files so ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Hard drive failed SBS - recover on another computer?
    ... As a general rule, if you didn't encrypt the contents, then you normally can ... If the case were that a folder had been specifically locked down to prevent ... the Administrator from view it, the Administator can take ownership of the ... > I am wondering if there is security in SBS2003 or NTFS ...
    (microsoft.public.windows.server.sbs)
  • Re: Encrypting a folder and all its contents.
    ... A particular folder that I can encrypt, ... First, I created a new folder, named it "TestEncrypt", right-clicked it, ... Back to WinXPpro Help, to read the Struck-Shuns, searched "decrypt", clicked ...
    (microsoft.public.windowsxp.general)