XP Encryption

[Teamaker]

I am trying to encrypt some folders on my XP Pro laptop but when i try it sez access denied, i have full controll and ownership of the forlders and files so way not?

Thanks people.

!!A good cup of Tetley keeps the madness at bay!!

 

[bcastner]

You cannot encrypt FAT32 filestores, only NTFS.

How to Encrypt a Folder

http://support.microsoft.com/default.aspx?scid=kb;EN-US;308989

 

[linney]

Are they compressed folders?

 

[Teamaker]

Thanks guys but the drive is NTFS and they arn't compressed.

!!A good cup of Tetley keeps the madness at bay!!

 

[bcastner]

CAUSE
This behavior occurs if the permissions on the System Volume Information folder are modified so that System cannot write files. Encrypting File System (EFS) uses the System Volume Information folder on each volume to store its log file that is generated during the encryption and decryption process. By default, the System security principal has Full Control of that folder.
RESOLUTION
To resolve this behavior, give the System security principal Full Control over the System Volume Information folder.

MS KB Q264064

 

[Teamaker]

I've never altered any setting on this folder but i checked anyway and System has special permissions Full control C:\system volume info.

!!A good cup of Tetley keeps the madness at bay!!

 

[Teamaker]

Silly me solved the prob. I had put the folder that i wanted to encrypt in the Windows dir apparently you can't encrypt folders in there moved it to my docs and no prob.

Thanks for help tho.

!!A good cup of Tetley keeps the madness at bay!!

 

[Teamaker]

Is there a way too export the encryption keys to back them up in case windows needs reinstalling?

!!A good cup of Tetley keeps the madness at bay!!

 

[linney]

Backup Encrypted Files
thread779-520853

 

[Teamaker]

Damn i managed to encrypt them and now i can't decrypt them, i just don't understand.

Any ideas?

!!A good cup of Tetley keeps the madness at bay!!

 

[pounderarthur]

Unless you are loggin into a domain, You will need to log into the system as the Local Administrator - and assign yourself as a recovery agent.

Reboot the computer to safe mode and log on as the adminstrator ... failing that
install a second HD, and format it as FAT, (2Gb is the largest you'll be able to format this drive via my computer interface) ... then MOVE the files from the NTFSv5.01 drive to the FAT ... this will automatically remove encryption

Arthur

 

[bcastner]

It most certainly will not remove encryption.

 

[Teamaker]

Thanks guys i've sorted it.

Just for info i was logged on as local admin when i encrypted them and when i tried to decrypt them.

Anyway i burned them to CD and then copied them back to my HD and it's all fine now.

Cheers.

!!A good cup of Tetley keeps the madness at bay!!

 

[pounderarthur]

Hiya,
For future reference MS KBQ 290 260, (

http://support.microsoft.com/default.aspx?scid=kb;en-us;290260),

explains how to recover encrypted data after a password reset ..

Arthur

 

[pounderarthur]

bcastner,
Please if you're going to state that I am wrong then please explain why ...However, in this case you're wrong ...

Just for inforamtion ... due to the level of encryption ustilised by EFS, (56bit - Standard, and 128Bit within US), copying / moving encrypted files to a FAT partition will automatically unencrypt the folder / files ...

Recommendation is to encrypt at the folder rather than the files .. because if an encrypted file is open then a "clear" & very accessible version of the file is created within the directory ..

Arthur

Don't just be a techie & slag someone off for offering a different opinion - because we live in a democracy we all have a voice - offer constructive critisism and a reason why you believe someone is wrong ...

 

[Teamaker]

pounderarthur you were right and thank you.
I had actually encrypted at the folder level, but for whatever reason i could not decrypt them. Simply logging on as administrator and burning the files to cd removed the encryption as CDFS does not support it, similar to what you said with the FAT HD.



!!A good cup of Tetley keeps the madness at bay!!

 

[bcastner]

pounderarthur,

I am not picking on you, I just find not a single aspect of your commnet to be true:

"Reboot the computer to safe mode and log on as the adminstrator ... failing that
install a second HD, and format it as FAT, (2Gb is the largest you'll be able to format this drive via my computer interface) ... then MOVE the files from the NTFSv5.01 drive to the FAT ... this will automatically remove encryption"

It is not true that someone who cannot do a local Administrator logon can install a slave disk, copy EFS files and have them automaticly decrypt.

You notion of partition size limits is also wrong.

The only recovery agents are:

. The creator/owner of the files and/or folders;
. In a non-Domain setting, the local Administrator;
. In a Domain setting, the Domain Administrator;
. In all settings, someone deliberately granted the security keys

Adding a second disk as non-administrator does not a thing to allow you to decrypt the files. Nothing. What you will end up with is a new hard disk full of unreadable folders and files.

 

[Teamaker]

bcastner, if you scroll up the post you will see that i said

"Just for info i was logged on as local admin when i encrypted them and when i tried to decrypt them.

Anyway i burned them to CD and then copied them back to my HD and it's all fine now."

Anyway not to worrt all sorted now.


!!A good cup of Tetley keeps the madness at bay!!

 

[bcastner]

Yes, I did note that point. And it is a very important point.

My objection is the notion that a non-recovery agent can simply copy the files to a FAT32 (or CD Rom) and the files will be decrypted.

It is decidely not true.

 

[Teamaker]

Yes you are correct on that point.

p.s i still didn't manage to decrypt the original files any new ideas there

!!A good cup of Tetley keeps the madness at bay!!