EFS: Almost all files are encrypted?! How did this happen?

[Ron]

Okay, I don't know a lot about EFS, so bear with me...

I'm the domain admin for a small company. We have a XP user who has somehow
managed to encrypt almost all of the files on her hard drive. I don't think
she's savvy enough to have set this up herself. Any idea how this would have
happened?

The odd thing is, if you look at the EFS info for one of these files, her
account is listed as the user and, sometimes, not all the time, one of our
contractor is listed as a recovery agent. That contractor has domain admin
rights. I haven't talked to him in a while, but before I do I want to have
my facts straight.

I thought under EFS all domain admins - I'm one of them - should have
recovery agent rights. The thing is I don't see anyone except this
contractor listed as a recovery agent on any of these files.

Any thoughts on what's going on? How did this happen?

Thanks for any help. I know it's kind of an esoteric questions, so let me
know if you need more info to answer it.

 

[David H. Lipman]

From: "Ron" <[email protected]>

| Okay, I don't know a lot about EFS, so bear with me...
|
| I'm the domain admin for a small company. We have a XP user who has somehow
| managed to encrypt almost all of the files on her hard drive. I don't think
| she's savvy enough to have set this up herself. Any idea how this would have
| happened?

The PC had NTFS and she Right-Clicked on the folders and chose to encrypt them.

|
| The odd thing is, if you look at the EFS info for one of these files, her
| account is listed as the user and, sometimes, not all the time, one of our
| contractor is listed as a recovery agent. That contractor has domain admin
| rights. I haven't talked to him in a while, but before I do I want to have
| my facts straight.
|
| I thought under EFS all domain admins - I'm one of them - should have
| recovery agent rights. The thing is I don't see anyone except this
| contractor listed as a recovery agent on any of these files.

Nope. Each individual will create their own Security Certificate that is used to
encrypt/decrypt files and folders. That Security Certificate, stored in the personal
Certificate Store, would have to be exported and placed on separate media. A copy for the
administrative staff and another copy for the end user. This is done to backup the original
certificate in case it is accidentally deleted by the end user.

|
| Any thoughts on what's going on? How did this happen?
|
| Thanks for any help. I know it's kind of an esoteric questions, so let me
| know if you need more info to answer it.

I can only say the end-user did this. Maybe inadvertently.