Re: Encrypted File System

Tech-Archive recommends: Fix windows errors by optimizing your registry

freakrz@xxxxxxxxxxx wrote:
Hi,

i run a sbs2k3 server and i have a folder that needs to be secured
from the administrator,but acessable to the other users.so after some
research i ve found out that i could use the encrypted file system to
encrypt the folder and files.it would block the access to the
admin,but still he would be the default recovery agent within the
domain.


The best you could do is make in 'inconvenient' for an admin.

so i figued out that i would create another admin account to perform
all the regular tasks/backups and use the domain admin just for
recovery purposes.

With enough admin group membership, the alternate admin can add to the
recovery agent lists.


i would also like to know if would help to create a new account and
give itself admin privleges to perform the routine tasks and
backups,instead of using the domain admin account?

It just reamains 'inconvenient' for the alternate admin. Don't forget about
backups and accounts that access to the backup files.


what permissions or groups should i assign the new account so that it
has all the admin access except for the efs key recovery?


EFS revocery is in group policy. If the admin had the priviledges to modify
the policy or add additionals, then they can read the efs files.

after i encrypt a folder and when i try to share the files within the
folder by adding users i recieve an message like this "no appropriate
certificates correspond to the user" how do i get the certificates for
the users that i want to let access?

prospective users must first encyrpt a file thereby optaining an efs cert
and have it published to ad.


i would also like to know ,if shadow copies enabled on the
server ,would retain the previous version of the folder/files?

Previous efs versions? Yes, I think so. Can't think of a reason why not.


what other things should i be aware before deploying the EFS.

Thank You.

Why you don't trust your admin.

--
/kj


.

Relevant Pages

  • Re: PF Admin tool & Administrative Rights
    ... Actually I am testing with our lab server and the Ex admin path is ... This path is correct in the server. ... My account has full admin rights to the ... I successfully received full information from the folder (size, create date, ...
    (microsoft.public.exchange2000.development)
  • Re: EFS recovery problem
    ... > groups *should* _not_ effect efs. ... >>A recovery agent will only be of use if it was set up before ... >>and since changing the group memberships of an account should ... Log out of Admin, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Even the Administrator isnt allowed to ....(two actions)
    ... You cannot access the folder in Doc&Settings because ... it is the profile of a different account and the NTFS ... This is the normal config for profile folders. ... Only admin accounts will be available in safe mode. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: PF Admin tool & Administrative Rights
    ... Path in that server!! ... Actually I am testing with our lab server and the Ex admin path is ... I successfully received full information from the folder (size, ... If I add the same account as client member as owner, ...
    (microsoft.public.exchange2000.development)
  • Re: User File Takeover ??
    ... I now have an admin file under my real name ... While logged on to the account that you normally use, ... What folder does Explorer focus on when it ... session for the inactive account is, well.., inactive. ...
    (microsoft.public.windowsxp.newusers)