If you're an administrator for an organization that uses the Encrypting File System (EFS), your disaster recovery planning must include additional procedures and preparations . You'll need to consider how to handle issues related to personal encryption certificates, EFS recovery agents , and EFS recovery policy. These issues are discussed in the sections that follow. Understanding Encryption Certificates and Recovery PolicyFile encryption is supported on a per folder or per file basis. Any file placed in a folder marked for encryption is automatically encrypted. Files in encrypted format can be read only by the person who encrypted the file. Before other users can read an encrypted file, the user must decrypt the file. Every file that's encrypted has a unique encryption key. This means that encrypted files can be copied , moved, and renamed just like any other file ”and these actions don't affect the encryption of the data in most cases. The user who encrypted the file always has access to the file, provided the user's public-key certificate is available on the computer that the user is using. For this user the encryption and decryption process is handled automatically and is transparent. The process that handles encryption and decryption is called the Encrypting File System (EFS). The default setup for EFS allows users to encrypt files without needing special permission. Files are encrypted using a public/private key that EFS generates automatically on a per user basis. The encryption algorithm used is the expanded Data Encryption Standard (DESX), which is enforced using 56-bit encryption by default. For stricter security, North American users can order the Enhanced CryptoPAK from Microsoft. The Enhanced CryptoPAK provides 128-bit encryption. Files that use 128-bit encryption can be used only on a system that supports 128-bit encryption. Encryption certificates are stored as part of the data in user profiles. If a user works with multiple computers and wants to use encryption, an administrator will need to configure a roaming profile for that user. A roaming profile ensures that the user's profile data and public-key certificates are accessible from other computers. Without this, users won't be able to access their encrypted files on another computer. Tip An alternative to a roaming profile is to copy the user's encryption certificate to the computers the user uses. You can do this using the certificate backup and restore process discussed later in this chapter. Simply back up the certificate on the user's original computer and then restore the certificate on each of the other computers the user logs on to. EFS has a built-in data recovery system to guard against data loss. This recovery system ensures that encrypted data can be recovered in the event a user's public-key certificate is lost or deleted. The most common scenario in which this occurs is when a user leaves the company and the associated user account is deleted. Although a manager might have been able to log on to the user's account, check files, and save important files to other folders, encrypted files will be accessible afterward only if the encryption is removed or they're moved to a FAT or FAT32 volume (where encryption isn't supported). To access encrypted files after the user account has been deleted, you'll need to use a recovery agent. Recovery agents have access to the file encryption key that's necessary to unlock data in encrypted files. To protect sensitive data, recovery agents don't, however, have access to a user's private key or any private key information. Windows Server 2003 won't encrypt files without designated EFS recovery agents. For this reason, recovery agents are designated automatically and the necessary recovery certificates are generated automatically as well. This ensures that encrypted files can always be recovered. EFS recovery agents are configured at two levels:
You can delete recovery policies if you don't want them to be available. However, if you delete all recovery policies, EFS will no longer encrypt files. Recovery agents must be configured for EFS to function. Configuring the EFS Recovery PolicyRecovery policies are configured automatically for domain controllers and workstations. By default, domain administrators are the designated recovery agents for domains and the local administrator is the designated recovery agent for a stand-alone workstation. Through Group Policy, you can view, assign, and delete recovery agents. Follow these steps:
|