Re: Problem with EFS in W2K....help!

From: Daniel Bonning (anonymous_at_discussions.microsoft.com)
Date: 06/12/04

  • Next message: Steve Riley [MSFT]: "Re: Using GPO security templates from WinXP Security Guide on Win2000 Pro machines" 
    Date: Sat, 12 Jun 2004 12:18:34 -0700

    Looks like I'm screwed :( I tried having the domain admin
    take ownership of the folder, importing the cert key on
    the file server, having the local admin of the workstation
    import the cert. Nothing is working. I just don't get it.
    Two weeks ago everything was fine and now nobody can
    decrypt the files....

    Doh!

    >-----Original Message-----
    >Encrypting files over then network can complicate things
    and unless you had your
    >user EFS private key imported onto that server you may
    not be able to decrypt
    >the files if you copied them to your local computer for
    decryption, so try to
    >decrypt tem on the server if you tried to do such on your
    local machine. If that
    >does not work use efsinfo /r /c on your files to see who
    is the recovery agent
    >and their certificates thumbprint which can help you
    track down the right
    >certificate/private key combo that should be able to
    decrypt your files. The
    >recovery agent could be the built in administrator
    account on that server or a
    >domain account which would be the built in administrator
    account on the first
    >domain controller in the domain by default [thumbprint
    info can help track down
    >correct account]. If you are using a XP Pro computer and
    your password was
    >"reset" by an administrator, that will cause loss of
    access to your EFS files
    >though if you change your password back to what it was
    before the reset you may
    >regain access. The links below may help. --- Steve
    >
    >http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%
    3B243026
    >http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%
    3B255742
    >
    >
    >"Daniel Bonning" <d.bonning@cmec.ca> wrote in message
    >news:1a74001c44e38$d8521690$a001280a@phx.gbl...
    >> Alright, here's the scenario:
    >>
    >> I am on a W2K network, where every AD user has a
    personal
    >> drive mapped in Windows (which is defined in our AD
    >> profiles as G:). The actual drive space resides on our
    >> file server and only the user and the domain
    administrator
    >> have access to it.
    >>
    >> Since the files that I keep on my G: drive are mostly
    of a
    >> personal nature, I had the brilliant idea to create a
    >> subfolder called "personal" and encrypt it and all files
    >> within it.
    >>
    >> This worked liked a charm until recently. All of a
    sudden,
    >> I can no longer access my own files!...nor can the
    domain
    >> admin.
    >>
    >> The only major change on our network has been a move
    from
    >> Exchange 2000 to Exchange 2003 on our main domain
    >> controller. Also, several times, we have run out of
    drive
    >> space on the system partition of our file server (which
    is
    >> also a domain controller) but that has been rectified.
    >>
    >> What the heck can I do to retrieve my encrypted files?
    >> When I try to decrypt the folder "personal" and its
    >> contents, the action just fails :(
    >>
    >> Please help. E-mail: d.bonning@cmec.ca THANKS!
    >
    >
    >.
    >

  • Next message: Steve Riley [MSFT]: "Re: Using GPO security templates from WinXP Security Guide on Win2000 Pro machines"

    Relevant Pages

    • Re: DC as a file server?
      ... Domain admin group is not a good ideea .. ... server operators group. ... >I guess my thoughts were that if a file server was a dc you would not be ...
      (microsoft.public.win2000.active_directory)
    • Re: Map drives using Run-As
      ... that is system behavior by design. ... file server to get full administrative access on it. ... context to admin of all subsequent net connections to that file server until ...
      (microsoft.public.windows.server.general)
    • Re: Cant Add or Remove Permissions to a Share That I Own
      ... Kevin wrote: ... > rights on a folder on our file server. ... I am part of the admin ... > group assigned to the folder and was also explicity added by name. ...
      (microsoft.public.windows.file_system)
    • Cant Add or Remove Permissions to a Share That I Own
      ... folder on our file server. ... I am part of the admin group assigned to the ... folder and was also explicity added by name. ... When network admin ...
      (microsoft.public.windows.file_system)
    • Re: Manage 30 XP, 2000, 98 without Domain Controller
      ... account on 98 machines) ... folders on the File Server, setup NTFS permission on each folder. ... How to prevent them from share out local folders, ... So is it possible to make the workgroup change ...
      (microsoft.public.windowsxp.security_admin)