PSS ID Number: 230490
Article Last Modified on 11/13/2003
The information in this article applies to:
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional
This article was previously published under Q230490
SUMMARY
The Encrypting File System (EFS) supports data recovery by allowing recovery agents to recover file encryption keys (FEKs) and decrypt users' files. The Encrypted Data Recovery policy (EDRP) is configurable for both a domain and a stand-alone server and must be configured by an administrator.
Once the EDRP is configured, it can be updated to specify who can recover FEKs in the event that a user's private key becomes unavailable or unusable. This may occur when an individual user account becomes damaged, is deleted, or becomes otherwise unusable. Multiple recovery agents can be configured, and in no case is any user's private key revealed to a recovery agent. When a user's private key becomes unavailable, an agent can use his or her private key to decrypt the FEK that was originally used in the file encryption process. After the FEK is obtained, the recovery agent can then decrypt the user's file.
MORE INFORMATION
To assist in FEK recovery, each FEK is encrypted with all public keys in the EDRP. Each encrypted FEK is stored in the Data Recovery field (DRF) containing the FEK created when a file is encrypted. If there is one recovery agent, there is one DRF for each encrypted file. When there are two recovery agents, there are two DRFs for each encrypted file, and so on.
The default on a stand-alone server includes only the local administrator in the EDRP. After the Dcpromo tool is used and a domain is realized, a default EDRP is created for the entire domain. At this point, all members of the domain participate in the EDRP. This policy uses a self-signed certificate to make the administrator account the recovery agent.
To make changes on a stand-alone server and add recovery agents:
- Start the Microsoft Management Console (MMC).
- Add the Group Policy snap-in for the local computer (this is the default Group Policy Object).
- Open the following sections: Computer Configuration; Windows Settings; Security Settings; Public Key Policies; Encrypted Data Recovery Policy.
- Right-click Encrypted Data Recovery Policy, and then click Add.
- Follow the instructions in the wizard to add recovery agents.
To make changes to a domain structure and add recovery agents:
- Start the Microsoft Management Console (MMC).
- Add the Group Policy snap-in for the default domain policy. To do this, click Browse when you are prompted to select a Group Policy Object (GPO). You can also add GPOs for other domain partitions (specifically, Organizational Units).
- Open the following sections: Computer Configuration; Windows Settings; Security Settings; Public Key Policies; Encrypted Data Recovery Policy.
- Right-click Encrypted Data Recovery Policy, and then click Add.
- Follow the instructions in the Wizard to add recovery agents.
For additional information about EFS, please see the following article in the Microsoft Knowledge Base:
223316 Best Practices for Encrypting File System
Keywords: kbenv kbinfo KB230490
Technology: kbwin2000AdvServ kbwin2000AdvServSearch kbwin2000Pro kbwin2000ProSearch kbwin2000Search kbwin2000Serv kbwin2000ServSearch kbWinAdvServSearch
