Disabling EFS–what to do if there are any encrypted files? – Managing your servers can streamline the performance of your team by allowing them to complete complex tasks faster. Plus, it can enable them to detect problems early on before they get out of hand and compromise your business. As a result, the risk of experiencing operational setbacks is drastically lower.
But the only way to make the most of your server management is to perform it correctly. And to help you do so, this article will share nine tips on improving your server management and fix some problem about windows, certificate-authority, encrypting-file-system, , .
I am in the process of retiring an old Windows-integrated CA and bringing online a new, properly-configured one (several, actually). Most of our systems are unable to use EFS thanks to Group Policy… but due to some misconfiguration, a handful of domain users were able to autoenroll for EFS certificates. So far, none of the users are aware of any files they have encrypted, and searching through their files with
cipher /u /n isn’t finding anything… but I can’t be sure that there are no encrypted files we have missed.
I must retire this CA soon, so I’ll have to revoke the EFS certificates and ensure that EFS is totally disabled for those users. I really can’t migrate the old CA to a new one either, for several reasons. So what are my options for shutting off EFS for those who may have been using it without losing their data?
At first I thought that you would want to create a Domain Recovery Agent. Then I was reminded that, (and I cannot confirm this), I believe that a DRA is only good for recovering encrypted files that were encrypted after the agent was created. Also, revoking the certificate might complicate matters some. Nonetheless, consider what you can do with the Domain Recovery Agent.
It does, however, appear that you have done everything that is reasonable to discern if any files have been encrypted. Get the list of all users that have had certificates issued to them, make sure they understand what is about to happen, get them to sign documents that acknowledge the situation and have it witnessed by a manager. Then, pull the pin and let the old CA float out to sea.
Further research revealed that the EFS certificates will continue to read any encrypted files as long as the user has the cert… even if the certificates are revoked and the CA is decommissioned.
What the users cannot do after the certs are revoked is (re-)encrypt any files… which we don’t want them to do anyway.
So thus I didn’t have to use CRL signing or any other tactics to keep the old CA on life-support; it is now fully decommissioned and the users (and any files they might have encrypted before) are intact.
(P.S. I may eventually have an issue if those user accounts need to be migrated to another domain in the forest, as the old EFS certs might not be migrated…)