Re: NTFS encryption on second drive inaccesible

From: Roger Abell (mvpNOSPAM@asu.edu)
Date: 06/02/02 

From: "Roger Abell" <mvpNOSPAM@asu.edu>
Date: Sun, 2 Jun 2002 09:44:46 -0700

Hi Bill,

Excellent points. It is precisely the standalone that needs this,
as in the domain (hopefully) central IT mgmt is preparing at a
higher level relative to recovery.

When XP docs started appearing, we provided exactly the
feedback you have here. That there should be a big red box
in all of the How-to or intro level EFS docs that flag the issues.
In all fairness, the prepare for recovery and the change password
gracefully issues are (usually) mentioned - but too often it is just
somewhere in a later paragraph - same font/weight/color.

For example, in the page obviously targeted at first-time EFS users
http://microsoft.com/WINDOWSXP/pro/using/howto/security/encryptdata.asp
you will find no mention of recovery, nor any link to recovery info,
but you will find a statement like
"Once you choose to encrypt a file, the actual process of data encryption
and decryption is completely transparent and requires nothing on your part."

Believe me, MVPs have flamed on MS for this. It is surprising the
apparent difficulty that can exist in driving the content writers to
make some changes. We have asked for higher visibility links to
http://microsoft.com/windowsxp/pro/techinfo/administration/recovery
and for a condensed, middle-ground, short, 1-2-3, recovery/dra-prep
How-to article with high visibility. 

--
Roger Abell
MVP (Windows Platform)  Associate Expert
The Expert Zone - www.microsoft.com/windowsxp/expertzone
"Bill Sanderson" <bill_NoSpamSanderson@msn.com> wrote in message
news:#4lHjrcCCHA.1904@tkmsftngp04...
> What I would like to see is some warning wording in any publicity articles
> about the feature, for example:
>
>
http://www.microsoft.com/windowsxp/pro/using/howto/security/encryptdata.asp
>
> To my mind, such an article must contain a warning up front, and a link
> somewhere in the body to a clearly delineated procedure for saving the
> certificate and private key.  I realize that this process is quite
different
> in a domain than on a standalone XP Pro workstation, but it's the folks
with
> the standalone XP Pro workstations who really need the help.
>
> Speaking of which--does anyone have such a link?--this would surely be
> useful, and I find the process rather difficult to find in Help and
Support,
> let alone give a reference to in a newsgroup message.
>
> "Roger Abell" <mvpNOSPAM@asu.edu> wrote in message
> news:OSxE9yTCCHA.2464@tkmsftngp05...
> > The most recent I have heard is that the changes suggested to
> > effect an unavoidable "caution notice" to first users all have
> > difficulties in implementing them now, after the fact, without
> > causing conflict in other areas.
> >
> > So, folks should read the info that has been made available
> > in the MS XP website on using EFS in XP.
> >
> > --
> > Roger Abell
> > MVP (Windows Platform)  Associate Expert
> > The Expert Zone - www.microsoft.com/windowsxp/expertzone
> >
> > "Patty MacDuffie" <pattymacduffie@SENDSPAMHERE.attbi.com> wrote in
message
> > news:OysQiDSCCHA.1436@tkmsftngp04...
> > It has been suggested to them by several MVPs numerous times, and is
being
> > looked into.  I don't know if they'll be able to get a fix into XP or
not
> > though.  It will certainly be in the next OS.
> > --
> > Patty MacDuffie
> > Windows XP MVP
> >
> > "Rod" <fake@fake.com> wrote in message
> news:e0IXsHLCCHA.1064@tkmsftngp04...
> > > This problem seems to come up often, maybe Microsoft should include
more
> > > warnings before attempting EFS.
> > >
> > > "Roger Abell" <mvpNOSPAM@asu.edu> wrote in message
> > > news:O#UQ6NKCCHA.2072@tkmsftngp02...
> > > > Load the previously saved cert/key, or restore the old system
> > > > from backup and log in with the account and password as it
> > > > existed at time of backup - or - say good bye to the files.
> > > >
> > > > --
> > > > Roger Abell
> > > > MVP (Windows Platform)  Associate Expert
> > > > The Expert Zone - www.microsoft.com/windowsxp/expertzone
> > > >
> > > > "Rod" <fake@fake.com> wrote in message
> > > news:uKkEcPFCCHA.1692@tkmsftngp05...
> > > > > There is no way of decrypting the data unless you backed up the
key.
> > > > >
> > > > > "Chris" <avatexjoel@aol.com> wrote in message
> > > > > news:8cfa01c20840$26b48890$a5e62ecf@tkmsftngxa07...
> > > > > > I moved my "MYDOCUMENTS" folder to another hard drive to
> > > > > > protect my data. It worked however when my system drive
> > > > > > crashed and I had to install XP prof on another drive I
> > > > > > can nolonger access mydocuments. I encryted them and the
> > > > > > apparently the encryption keys are lost. Does anyone know
> > > > > > of anyway to recover this data? I know the original
> > > > > > passwords for the administrator, but I cannot find the
> > > > > > backup of the encryption keys. Any advice would be
> > > > > > appreciated.
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
> >
>
>

Relevant Pages

  • Re: Have key(s) for EFS files, still denied
    ... Hopefully the data recovery company can get the key. ... EFS files from your description. ... In the fall of 2004 we bought a new Dell laptop and I moved/copied EFS ... In October 2005 I reformatted our Gateway C partition and re-installed XP. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Corrupted Admin Profile
    ... > My view on EFS: ... > Do not to use encryption unless you are in a domain and you know ... as well not having created a Recovery Agent (with backup of the ... > Q241201 How to Back Up Your Encrypting File System Private Key ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Replace Domain Controller
    ... Depending on your EFS recovery you may also want to backup your EFS private ... Export your Private Key from Recovery Agent ... private key so that you can recover encrypted data in the event that you ...
    (microsoft.public.windows.server.active_directory)
  • Re: cant decrypt EFS encrypted files
    ... There is a myth on the net that doing just that will decrypt the data. ... If it were that simple EFS would be worthless. ... >> Contact Microsoft if you can restore the profile. ... >>> this I soon discovered that is possible to create Recovery Agent ...
    (microsoft.public.windowsxp.security_admin)
  • Re: cracking Windows 2000 EFS
    ... "Four Simple EFS Hacks ... local Administrator account is the Data Recovery Agent, ... the recovery computer as the recovery agent account and then use Cipher to ...
    (Security-Basics)