Password Reset and EFS

[rgzimmer]

I have a user that loses access to his encrypted files every time he changes his password. This happens no matter what method he uses to change it.

- Gets the notice that his password is expiring so he changes it as prompted - breaks encryption

- Uses the change password option after pressing ctrl-alt-del - breaks encryption

- Changes password from the users admin - breaks encryption, as it states it will.

Anyone else have any experience with thsi? This is on a laptop that is not attached to a domain. Passwords are required to change every 43 dats.

 

[bcastner]

To enable changed password access to the recovery keys:

1. Install Windows XP SP1.

2. Use the Registry Editor to navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb.

3. Edit or add Value Name MasterKeyLegacyNt4Domain, a REG_DWORD data type, and set the data value to 1.

 

[bcastner]

There is a well-written patch for this issue:

https://ess.saic.com/efsxpfix.exe

 

[rgzimmer]

I have 130 laptops deployed with the same config and this is the only one with this problem. I can recover the encrypted files just fine by changing the password back. I just don't want to keep doing that.

I also have the cert exported to a file in my posession just in case the account is irrecoverable. I don't send that file out, though, because it will invartiably end up unencrypted on his laptop and therefore easily accesible by anyone who might steal the system.

 

[rgzimmer]

bcastner,

Is there any documentation on what the patch fixes?

Thanks a bunch for your help!

 

[bcastner]

You in fact should not have the issue if Service Pack 1 is installed.

It is possible a system restore point was used to revert to pre-SP1.

In any password change operation that uses an offline change; i.e. any password change that does not require entering the old password and then the new password; the EFS store will be affected. This is "by design."

For whatever reason the NT compatability registry switches are not right on this particular laptop. As I said earlier, you can either make a simple registry edit or use the patch I linked earlier.

This is not a completely unknown phenomena, and the changes I suggested in earlier posts will reverse the behavior.

 

[bcastner]

https://ess.saic.com/xp-encryption.html

Essentially it does what the registry entry I detailed earlier performs: it clarifies that the workstation is not receiving a policy demand to change the password from a Win2k GPO, and forces the registry to reflect a workstation in a Workgroup or NT4 Domain setting.