Re: EFS Certs in AD or local PC?

Just to add that EFS files can not be copied by anyone other then a user
that can decrypt them but a user can use NTbackup to back them up to be
restored on another computer such as one where the RA certificate/private
key exists for attempted decryption. Also RA certificate/private key can be
imported via password protected .pfx file to a computer for attempted
recovery of EFS files.

The users EFS private key is stored in the user's profile but not in a way
that can be normally exported. There are third party tools that can scan a
computer to look for EFS private keys [such as from a restored profile to a
computer other than the original OS] that can possibly decrypt EFS files if
the user's password is known. If there are no correct EFS private keys [user
or RA with matching thumbprint] available to decrypt a users EFS files then
it will not be possible to recover the EFS files.

Steve

http://www.elcomsoft.com/aefsdr.html --- free trial can be used to search
for and unlock EFS private keys but if found the free version will only
decrypt a couple bits of EFS file, just enough to let you know full version
should work

"Steve" <wonderlan1@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:Ojo7H3YwIHA.4876@xxxxxxxxxxxxxxxxxxxxxxx
While there are ways to archive EFS certificate/private keys, I believe
that requires W2003 Enterprise, and in your case his certificate/private
key was on the local computer. See if he possibly exported it for backup
at some point in time to see if he can import it back into his computer
via a .pxf file. If the domain security policy has a Recovery Agent
configured then the RA [usually built in domain administrator account]
could logon to a computer that contains the RA EFS certificate/private key
[usually the domain controller] and deccrypt the files. Note that ANY EFS
certificate used to attempt to decrypt files MUST also have the matching
private key - a .cer file does NOT. Though he/you may not be able to
access the files right now you can view the advanced properties/detains of
them to see if a RA is included as user that can decrypt.

Steve


"Quilnux" <Quilnux@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:95785FD5-839E-4A23-B4C9-974A3E6884B2@xxxxxxxxxxxxxxxx
Hello,

We have a user which was using a desktop with an EFS folder. Recently the
OS
drive failed and we had to reload the system from a new HDD. The EFS
folder
is on a secondary drive which is ok but I need to know if he will be able
to
access the folder when he logs in next wednesday from his account in AD
or if
I need to get his EFS cert from archives. It takes archives a week to get
us
the disks we need so if it is saved in his AD account I may not need to
contact them.

Thanks,
Quilnux




.

Relevant Pages

  • Re: EFS Certs in AD or local PC?
    ... If his profile is in AD and we import his cert, will he be able to decrypt ... The users EFS private key is stored in the user's profile but not in a way ... If there are no correct EFS private keys [user ... configured then the RA [usually built in domain administrator account] ...
    (microsoft.public.windows.server.sbs)
  • [Full-disclosure] Re: Windows XP Home LSA secrets storesXP loginpassphrase in plain text (John D
    ... you can decrypt the EFS for _all_ users on the computer. ... In Windows XP the EFS private key is encrypted using users passphrase and without the passphrase, you cannot decrypt it. ... Administrator is the recovery agent and can decrypt all EFS files anyway. ... Users private keys are not stored encrypted in the system and anyone who can simply sign in with that users credentials can decrypt users EFS files. ...
    (Full-Disclosure)
  • Re: External disk security
    ... computers I have administrator access and I do not need it on any ... > The only way would be to use encryption such as EFS. ... > decrypt the EFS files since they would not have access to the ...
    (microsoft.public.win2000.security)
  • Re: External disk security
    ... No. Encryption overrides ntfs permissions as far as access to the data. ... the file or know your password AND have access to the EFS private keys. ... If your disk was stolen and attached to another ... it to their computer and you will see they can not access the data in the EFS files ...
    (microsoft.public.win2000.security)
  • Re: EFS- manipulated UserPassword
    ... administrator account is also the Recovery Agent in Windows 2000. ... account to access EFS files, ... upgrade to XP Pro OR export/delete the user's and Recovery Agent's EFS ...
    (microsoft.public.win2000.security)