Re: Encrypting Remote Files with EFS



Star Fleet Admiral Q
07-09-2005, 10:50 PM
The user encrypting on one, logging on to another and being able to decrypt
sounds about right, as these are "domain" profiles, so as they move from
machine to machine, the same domain profile would be loaded to the
PC/laptop - I'll assume these are roaming profiles? Maybe not?

As far as the cert footprint, which one are you comparing, the "public" or
"private" cert - the "public" one should be different, as the are different
machines, but the "private" cert should be identical.

For the rest, some of the other experts will need assist, as why some do and
some don't, I agree with you, if none are trusted, then it shouldn't allow
none.

--

Star Fleet Admiral Q @ your Service!

http://www.google.com
Google is your "Friend"

"Zack" <None@none.com> wrote in message
news:op.sqkb2nspobdjke@zschielxp.blueco.com...
> We are in the midst of deploying EFS to protect specific folders on laptop
> hard drives. We want EFS used only for that purpose-locally; as such, we
> do not want users to have the ability to encrypt files that are residing
> on file servers. According to my understanding of EFS, which seems to be
> confirmed by the quote below from Windows help, users shouldn't be able to
> do so unless we specifically enable file server(s) to be trusted for
> delegation in AD.
>
> "In a domain environment, remote encryption is not enabled by default. To
> enable encryption for a specific computer, your network administrator can
> make that computer trusted for delegation. For more information, consult
> your network administrator."
>
> However, some of our servers are allowing files to be encrypted and
> decrypted remotely-and these servers are *not* marked as trusted for
> delegation in AD. Further, the user that encrypted the file can scoot
> over to another PC, log in as themselves, and access the file-and we have
> no CA infrastructure in place; these are locally-generated EFS
> certificates that do not chain back past the local client machine. The
> certificate thumbprints in the personal store for the user account on the
> two PCs do not match, yet they can access the file just the same, while
> other user accounts cannot.
>
> I'm thoroughly confused by this behavior, and would appreciate any experts
> chiming in and cluing me in as to why 1) some servers are allowing remote
> encryption, while others are not, and 2) why locally-generated EFS certs
> are behaving this way.
>
> Our environment:
>
> -Windows 2000 native-mode domain
>
> -All DCs are Win2k, file servers are a 2k/2003 mix
>
> -Clients are 2000/XP; the OS of the client/server doesn't seem to matter-
> some 2k3 servers allow remote encryption, some don't, and some 2000
> servers allow, while others don't.
>
> Thanks,
>
> -Zack-


Re: Encrypting Remote Files with EFS