Question on EFS...

[Patrick Saunders]

Hi,
I am studying to do my first MS exam, for 70-290.
I have a question from the Syngres 70-290 book that I don't
understand.
From Chapter 5, question 14 Self Test:

========
14. You have an encrypted file that you want to share with another
user,William.The file is stored on your local Windows 2000
computer.You create a share on your computer,and give William share
and NTFS permissions to the folder where the file is located.
How will you prepare the file with EFS so that only the recipient can
access the contents of the file?

A. Open a command prompt and encrypt the file using cipher /e /u
username filename.

B. Open a command prompt and encrypt the file using cipher /e
/xutputfile filename.

C. Open the Properties window of the file, click Advanced, select the
Encrypt this file check box, click Details, and then add William to
the list of users who can decrypt the file.

D. You cannot do this with EFS.
==========

The correct answer is D.

According to Microsoft articles on technet, it says you can only add
certificates for users that are
A)in Domain ,
B)On local machine.
Is this correct?

OR, is it due to the added functionality in explorer for EFS in
Windows XP that did not exist in Win 2000 ??

I would apppreciate if someone can clarrify this!

Thanks in advance,

Patrick.

 

[Steven L Umbach]

You can not share EFS encrypted files with other users in Windows 2000. That
was a feature added to XP Pro. Note that it is possible to have more than
one user decrypt a file as the recovery agent can also decrypt it. Windows
2000 requires a RA while XP Pro does not. --- Steve

http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/cryptfs.mspx
-- explains how to share EFS files in XP Pro/W2003 and a lot more.

 

[Patrick Saunders]

Thanks Steve,

Much appreciated. I am learning that you have to read the question
VERY carefully as one word can change the answer..!

pat.

 

[David Cross [MS]]

One small note - Windows 2000 machines CAN open a file that was shared with
them by Windows XP. There just is no UI in Windows 2000 to add or remove
users.