Encrypting files in XP

[Eric]

I want to encrypt some files in XP but I really don't
understand what it does. When I encrypt a folder it
appears like it is colored green. I know this is a
security feature.

How does this secure files and folders? It isn't allowing
me enter a password for it. I was on a XP Home machine, I
seen this option was unavailable. It was greyed out.

Does this only work with XP Pro? Does this only prevent
you from making changes but still availabe for you to
read?

 

[Jupiter Jones [MVP]]

EFS (Encryption File System) is not available on Windows XP Home.

Read and thoroughly understand the information #5 on this link:
http://www3.telus.net/dandemar/encrypt.htm
Failure to do so will most likely result in PERMANENT LOSS of all
encrypted data.

 

[Torgeir Bakken \(MVP\)]

I want to encrypt some files in XP but I really don't
understand what it does. When I encrypt a folder it
appears like it is colored green. I know this is a
security feature.

How does this secure files and folders? It isn't allowing
me enter a password for it. I was on a XP Home machine, I
seen this option was unavailable. It was greyed out.

Does this only work with XP Pro? Does this only prevent
you from making changes but still availabe for you to
read?

Hi

WinXP Home does not support Encrypting File System (EFS).

Only users with access to the private encryption key (or a DRA
key) will be able to decrypt encrypted files.

Read and understand the information in the links below before you start
using Encrypting File System (EFS), or you will very likely loose your
files one time in the future (e.g. exporting and saving the private key
in a safe place is extremely important):

Encrypting File System in Windows XP and Windows Server 2003
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/CryptFS.asp

Best Practices for the Encrypting File System
http://support.microsoft.com/default.aspx?scid=kb;EN-US;223316

 

[Eric]

Thanks guys!

Does this work over the network or will I have to install
IP Security Protocol in order for this to work. I beleive
I've read somewhere that this doesn't work on computers
running Win2k unless that protocol is installed.

Is that the same with Windows XP?

 

[Eric]

This is a workgroup environment. Is isn't part of a
domain.

 

[Eric]

I have a problem, I cannot follow the directions in that
link Torgeir. When I right-click the encrypted folder,
the Details button is greyed out. That MS KB Article says
to click Details to add additional users but I cannot do
it.

What's the problem?

 

[Miha Pihler]

Hi Eric,

You can encrypt the folder and it's content but if you need other user to
access this files in this folder you will have to do it file by file...

Mike

 

[Miha Pihler]

Hi again Eric,

No, files that you encrypted on the hard drive won't get transferred in
secure way (encrypted). If you need to send them encrypted, you will have to
use IPSec. Same goes for Windows 2000.

Another thing about Windows 2000, you can't have more users accessing same
file (you can't add additional user to the file).

Mike

 

[Eric]

I have two XP Pro machines, and and third maching running
XP Home. They are in a workgroup environment, not part of
a domain. I have a folder called "Encrypt" for testing
and allowed the users with XP Pro advanced file sharing
to access that folder but when they do, they get a access
is denied error message. They cannot open that folder
across the network. Any ideas?

 

[Eric]

Also, the Details button on the Encrypted folder is
unavailable and greyed out. However, when I click a file
it is available.

When I try to add users, I cannot add other users and
follow this MS KB Article 223316 that Torgeir posted.
When I click "Add" to add users, the Find User button is
grayed out and the local user is the only user.

How do I add network users?

 

[Miha Pihler]

I could user some more information. Did you share this folder? When do users
get the error message? When they try to open a file or when they try to
access the folder?

Mike

 

[Miha Pihler]

You need to get the other user's public key (_not_ private key!). Once you
have it, import it into your profile and you will be able to grant this user
rights to open and edit the encrypted file...

If you don't have CA (Certificate Authority) set up, you can use self signed
certificates. All that user has to do is encrypt one file on his PC and he
will be issued a certificate.

Don't forget to make backup copies of _private_ keys or you are in danger of
losing access to your files for good! EFS is _very_ good at what it does and
if you lose your private keys you lose access to your files for good!

If your users have weak and easy to guess passwords then there is no use in
EFS. This (easy to guess) password protect user profile in which private
keys are stored and protected. If I can guess a password I get full access
to all encrypted files!

Mike

 

[Star Fleet Admiral Q]

If you are having problems with the XP Pro machines, that another
story, but if it is the XP Home machine, stop worrying, XP Home is not
able to encrypt/decrypt files - it was written that way on purpose by
MS.