How To Access EFS-encrypted Files On Other Locations

Situation

The backup plan contains EFS-encrypted files and the Keep EFS encryption option is selected.

This means that EFS-encrypted files are backed up and kept on backup storage encrypted. The main purpose of any backup is the guaranteed ability to restore data when needed: after a hardware failure or for any other reason. In most cases, the restore does not require any special actions, but the situation with EFS-encrypted files backed up 'as is' is a bit different: it is tightly bound with the EFS-encryption specification that covers the decryption with the security layer.

Thus, if you keep your EFS-encrypted files backed up 'as is' (encrypted), make some preparations to protect yourself from unpleasant moments that may occur when trying to read restored EFS-encrypted files on a location other than the original computer (the one from which these EFS-encrypted files were backed up).

Determine the way that suits you best and follow the instructions stated below:

• Back Up EFS Certificate
• Key Archival of EFS Recovery Certificate

Back Up EFS Certificate

To back up an EFS certificate, open the MMC console and add the Certificates snap-in. From here, it is possible to browse certificates associated with a user or computer. In this case, the personal store is browsed.

1. Right-click the certificate to back up, then select All Tasks > Export.

2. The Certificate Export Wizard appears. Click Next.
3. Select the Yes, export the private key option.

4. Select the format to export in. When exporting the private key, the .PFX format is generally a standard in Windows. If only the certificate is exported, you can export it in the .CER format instead.

5. As the private key must remain secure, create a password for the file.

6. Select the location and name for the exported file.

7. Check your settings, then click Finish to complete the process.

Once the procedure is completed, a pop-up notification appears. The created .pfx file contains the exported certificate and the private key in the location specified.

| Top |

Key Archival of EFS Recovery Certificate

Follow these steps:

• Step 1. Add Key Recovery Agent Certificate Template
• Step 2. Request Personal Administrator Certificate
• Step 3. Add a Key Recovery Agent Certificate Using Group Policy
• Step 4. Force Update Group Policies
• Step 5. Use Key Archival

Step 1. Add Key Recovery Agent Certificate Template

Add the Key Recovery Agent certificate template to the list of available certificate templates.

1. Log in to the Certification Authority computer with administrative rights.
2. In Windows Administrative Tools, click Certification Authority.
3. In Certification Authority, right-click Certificate Templates and select New > Certificate Template to Issue.

4. Select Key Recovery Agent in the list of certificate templates.

5. Click OK to enable this certificate.
6. A Key Recovery Agent certificate template appears in the list of Certificate Templates.

Now you are ready to request a personal administrator certificate using this Key Recovery Agent certificate template.

| Back to the step list |

Step 2. Request Personal Administrator Certificate

To request a personal administrator certificate using the Key Recovery Agent template published above, proceed as follows:

1. Open the MMC console and add or select the Certificates snap-in.
2. Right-click the Certificates folder under the personal store, and select All Tasks > Request New Certificate.

3. In the Certificate Enrollment dialog, select Key Recovery Agent in the list of available certificates, then click Enroll.

4. In Certification Authority, click the Pending Requests folder.
5. Right-click your pending request, then select All Tasks > Issue to issue the certificate requested above. Save the Request ID copy of the certificate to a file.

6. The certificate appears in the Issued Certificates folder. Right-click the certificate and select Open.

7. Select Thumbprint and click Copy to file.

8. Export the certificate to a file, for example, archive-admin.cer, with the Certificate Export Wizard. On the Export file format step, select DER encoded binary X.509 (.CER).

9. In the Certification Authority snap-in, add and configure the Recovery Agent. Right-click the domain, then select Properties.

10. Click the Recovery Agents tab.
11. Select the Archive the Key option. Click Add.

12. Select the certificate you issued and verify that the thumbprint of this certificate matches the thumbprint saved to the file above. Click OK.

13. Restart Active Directory Certificate Services for changes to take effect.

14. In Properties, click Recovery Agents to check whether the certificate is valid. Click Cancel.

15. Add a new EFS template based on the Basic EFS template. In Certification Authority, right-click Certificate Templates and select Manage.

16. Right-click the Basic EFS template and select Duplicate Template.

17. Configure the new template properties:
    • Name the template on the General tab.

* On the Request Handling tab, select **Archive subject's encryption private key**
* On the Cryptography tab, set the minimum key size.

* On the Security tab, grant the Read permission to the Key Recovery Agent account.

18. Click Apply.
19. Publish the created certificate template. In Certification Authority, right-click Certificate Templates and select New > Certificate Template to Issue.

20. Select your template by name and click OK to enable it.

Now you are ready to add this Key Recovery Agent to Group Policy.

| Back to the step list |

Step 3. Add a Key Recovery Agent Certificate Using Group Policy

1. Open the Group Policy Management snap-in.
2. Right-click Default Domain Policy and select Link Enabled.

3. To edit the Default Domain policy, expand Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies. Right-click Encrypting File System and select Properties.

4. On the General tab for Encrypting File System (EFS), select Allow.
5. On the Certificates tab, select your template as the EFS template for automatic certificate requests and clear the Allow EFS to generate self-signed certificates when a certification authority is not available check box.

6. Click Apply.

Now you are ready to update group policies on the computers where you want to back up EFS files.

| Back to the step list |

Step 4. Force Update Group Policies

• Log in to the original client computer and run gpupdate /force.

Now the created Group Policy is used on this computer. You are ready to check whether key archival works properly.

| Top |

Step 5. Use Key Archival

1. Log in to the original computer as a standard user that does not have an EFS certificate.

3. Create and encrypt a file.

4. Make sure that the new user has access to the encrypted file.

5. The same certificate appears in the user's personal store.

6. Log in to the Certification Authority computer.
7. In the Certification Authority snap-in, click View > Add/Remove Columns....

8. Add the Archived Key column and move it to the top of the list. Click OK.

9. Note that a standard user certificate was automatically issued and archived.

10. Install previously exported Recovery Agent certificate c:\archive-admin.cer to the administrator's personal store on the Certification Authority computer.

11. Locate the issued and archived ordinary user EFS certificate in Certification Authority and copy the serial number to the clipboard.

12. Run PowerShell as Administrator.

13. Execute the following commands in the PowerShell window. At the last step, specify the recovered .pfx password.

 cd /

mkdir keyrecoverdir

cd .\keyrecoverdir\

certutil -getkey 170000001b7f4141464204e1b500000000001b rawkeyinfo

certutil -recoverkey .\rawkeyinfo recovered.pfx

14. Now the standard user .pfx certificate is recovered.

15. Log in to the original client computer where you created the EFS-encrypted file.
16. Delete the EFS keys/certificate.
17. Place recovered.pfx in the file system.
18. Install recovered.pfx to the ordinary user's personal certificate store.
19. Log in again to the original client computer to uncache the certificate thumbprint.
20. Try to open your EFS-encrypted file to make sure everything is fine.

| Top |