Re: EFS Nightmare

From: Bill Peedle (bpeedle@peedle.com)
Date: 02/21/03


From: "Bill Peedle" <bpeedle@peedle.com>
Date: Fri, 21 Feb 2003 13:41:29 -0800


Thanks for the tip, Roger. The thumbprint on the files
that I cannot open does not match the thumbprint on the
certificate I origionally exported. So my question becomes
this - same user id, same computer, same domain,
certificate exported and deleted off of the pc. Something
changed the thumbprint on my recently used encrypted files
without my knowledge, and without generating a new
certificate so that I can export that certificate for
recovery purposes. I am guessing that a certificate
existed at some point that I could have exported as a
recovery key. Well, how do I go about getting my data back
now?
>-----Original Message-----
>"Bill Peedle" <bpeedle@peedle.com> wrote in
news:037e01c2d945$989493c0
>$a201280a@phx.gbl:
>
>> Yes. I changed my password to what it was yesterday
>> (using the ctl-alt-del change password, not users and
>> groups snap-in). This did not work. I was under the
>> impression that the certificate goes along with the
>> encryption, and that I should be able to import the key
>> on any machine (even one that I reloaded from scratch)
>> and that would give access to the file. This doesn't
seem
>> to be the case for all of my files.
>>>-----Original Message-----
>>>"Bill Peedle" <bpeedle@peedle.com> wrote in
>> news:013901c2d914$6c0119e0
>>>$a301280a@phx.gbl:
>>>
>>>> Hello, everyone. Here is a question that I would like
>> to
>>>> pose. I have been using EFS with Windows XP now for a
>> few
>>>> months. It has been working great until yesterday. I
>>>> followed all of Microsofts rules when using EFS, and
I
>>>> have a copy of my recovery certificate exported and
in
>> a
>>>> safe place. Yesterday, I changed my password (this is
>> the
>>>> only thing that I can think of) and later in the
>> evening
>>>> rebooted my PC. Now I can not access some of my
>> encrypted
>>>> files (some of them I can still access). So, as
>> Microsoft
>>>> suggested, I reimported my recovery key, and I still
>>>> cannot access many of my files. My user id has not
>>>> changed. Any ideas?
>>>>
>>>
>>>Have you tried changing back you password ?
>>>If the account was an admin there are two ways to
>>>change the password, one should keep EFS access and
>>>the other should break it.
>>>
>>>--
>>>Roger Abell
>>>MS MVP (Windows Security)
>>>.
>>>
>>
>
>Well, your impression is correct.
>You may want to use the utility efsinfo to see what
>the thumbprint is on the files that will not come
>clear. This tool is part of the support tools optional
>install from dir of same name on the CD.
>
>--
>Roger Abell
>MS MVP (Windows Security)
>.
>



Relevant Pages

  • Re: EFS woes
    ... I changed my domain password which broke EFS 1. ... not the same thumbprint as on my exported certificate. ... inheriting the encryption status. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: EFS Decryption - Lost Certificate
    ... the older certificate's thumbprint matches the thumbprint in the ... When I double click on that certificate, ... General Tab it says "You have a private key that corresponds to this ... didn't make a backup of the encryption certificate, ...
    (microsoft.public.security)
  • Re: EFS Decryption - Lost Certificate
    ... the older certificate's thumbprint matches the thumbprint in the ... When I double click on that certificate, ... General Tab it says "You have a private key that corresponds to this ... didn't make a backup of the encryption certificate, ...
    (microsoft.public.security)
  • Re: encrypted folders & files
    ... The thumbprint on the certificate I have backed up on ... >> I DID back up my encryption key, have restored it, made ...
    (microsoft.public.windowsxp.security_admin)
  • Re: EFS decryption problem solved!! FYI stuff inside.
    ... > certificate "thumbprint" for the file in question, ... > from the backups which had the corresponding certificate intact. ... Functionality is limited on Windows XP, but the Windows 2000 recovery is a real eye ... the syskey mode 2 password or insert the mode 3 floppy. ...
    (microsoft.public.security)