Re: EFS Errors

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 08/17/05 

Date: Tue, 16 Aug 2005 18:45:11 -0500

You don't mention the operating system of the domain controller or the
domain computers but there is a KB article that refers to the errors you are
seeing that may help provide a clue as shown below.

http://support.microsoft.com/?id=842804

Disabling DFS can disrupt your Group Policy propagation which may be causing
your EFS errors if you have changed your Recovery Agent Certificate. The EFS
error could be caused by an expired or absence of an EFS RA certificate that
Windows 2000 computer require before users on a W2K computer can encrypt
files via EFS. I would run the support tools netdiag, dcdiag, and gpotool on
your domain controller to make sure no serious problems are found that could
prevent Group Policy from working correctly. Also run netdiag on at least
one of the domain computers that is having problems with EFS and the support
tool gpresult to see what Group Policy is being applied to the domain
computer and the last time it was applied. Verify that the user has a
certificate that can be used for file encryption in their local certificate
user store that is available via the mmc snapin for user certificates in the
personal/certificates folder. It is not a good idea to delete
certificates/private key as that could result in the inability for a user or
Recovery Agent to decrypt files they have previously been encrypted. You can
use the efsinfo utility to see what certificates/private key can decrypt an
EFS file for user and RA. If you are using Group Policy to manage the
Recovery Agent for the domain make sure that a valid certificate is
configured as the RA and that domain computers within the scope of
management are receiving the Group Policy. Gpresult can help determine that.
You can use the /v or /z switch for more info using gpresult. If using GPMC
or Windows 2003 domain controller the Resultant Set of Policy mmc snapin can
help determine Group Policy applied to a user or computer. It can take up
to two hours for changes to Group Policy to propagate to domain
computers/users unless you use gpupdate/secedit or logoff/reboot to speed up
propagation. --- Steve

"LarMan" <LarMan@discussions.microsoft.com> wrote in message
news:B0F6320C-7D9B-4B7F-BD8E-6F8A27FFA48D@microsoft.com...
> Hello, I have been encrypting fine until about 1 week ago. For various
> reasons I stopped and disabled DFS on the AD server. Then my EFS went
> nuts
> so I turned it back on but I am still getting errors about encryting
> files.
> The errors are 1058 and 1030 as well as the EFS 6028. I have renewed
> certs
> and delete all and requested new certs, nothing is working. I looked for
> the
> dfsenable in the registry key MUP but did not find one and am hestitant to
> add one. I am able to encrypt on the server but noone is able to encrypt
> on
> the workstation. Any help would be much appreciated.

Relevant Pages

  • RE: EFS File Share Help
    ... And your roaming profile cannot work properly. ... If user tries to encrypt a remote file/folder stored ... user, and subsequently requests, or generates a self-signed EFS ... The certificate and private key are loaded in a local profile ...
    (microsoft.public.windows.server.sbs)
  • Re: EFS Errors
    ... > domain computers but there is a KB article that refers to the errors you are ... > your EFS errors if you have changed your Recovery Agent Certificate. ... > prevent Group Policy from working correctly. ...
    (microsoft.public.security)
  • RE: EFS rollout using Active Directory
    ... I just have something to add to the Final Thought regarding laptop users: ... You can implement EFS on systems running Windows 2000 and Windows XP ... Stand-alone workstations generate their own public key certificate that you ... encrypt the contents of their files or folders. ...
    (Focus-Microsoft)
  • Re: Restoring Encrypted Files
    ... I'm using EFS because of Microsoft recommendation to do so on portable ... clients. ... >> If I encrypt files on an XP Pro client and backup those files using NT ... > corrupted or missing certificate, it is critical that you back up the ...
    (microsoft.public.windows.server.sbs)
  • EFS: What am I doing wrong?
    ... here is what I want to do: I want to encrypt some files I have on my ... notebook so that if someone steals it from me, he would not be able to ... I created a separate folder named EFS on the C: ... Then I've exported my encryption certificate to a file on a diskette. ...
    (microsoft.public.windowsxp.security_admin)