EFS (encryption) Question

[Bob Gruett]

I've run into an odd situation that I'm hoping someone with a little more
experience can help me with.

At work, I have a laptop running XP Pro that logs on to a corporate domain.
On this laptop I have a number of files which I have encrypted (files
containing passwords, etc...). As far as I can tell, the encryption works
exactly as it should, as only I am able to open said files.

At home, I have a test network which includes a Windows 2000 Server which
works as a DC, a DNS server, and a file server. I have both personal and
public shares set up on this PC.

Recently I connected my work laptop to my home network and copied all my
file data to my personal server at home. In order to establish a connection
with my personal share I had to map a drive using alternate credentials, and
the credentials I supplied were my logon and password for my home domain.
No problem. I copied all the files, disconnected, and that was that.

Here's the odd part:

When I attempt to access the encrypted files I copied to my home
network, while logged on to my home network using my home network domain
credentials, I am able to open everything just fine. No warnings, no
errors, and while I have Windows Explorer set to color code encrypted and
compressed files and folders, but these objects show no indicative color
coding. At a glance, it appears all encryption has been stripped of the
files.

But, if I pull up the file properties, they are clearly marked as
encrypted.

So here's my question:

Is it possible, that since I used alternate credentials to copy the
files from a laptop in one domain to an NTFS file system of a PC in another
domain, the encryption was adjusted to reflect these alternate credentials?
I've read some articles and that's my guess right now, but I haven't seen
anything definitive.

 

[Vagabond Software]

I've run into an odd situation that I'm hoping someone with a little more
experience can help me with.

At work, I have a laptop running XP Pro that logs on to a corporate
domain.
On this laptop I have a number of files which I have encrypted (files
containing passwords, etc...). As far as I can tell, the encryption works
exactly as it should, as only I am able to open said files.

At home, I have a test network which includes a Windows 2000 Server which
works as a DC, a DNS server, and a file server. I have both personal and
public shares set up on this PC.

Recently I connected my work laptop to my home network and copied all my
file data to my personal server at home. In order to establish a
connection
with my personal share I had to map a drive using alternate credentials,
and
the credentials I supplied were my logon and password for my home domain.
No problem. I copied all the files, disconnected, and that was that.

Here's the odd part:

When I attempt to access the encrypted files I copied to my home
network, while logged on to my home network using my home network domain
credentials, I am able to open everything just fine. No warnings, no
errors, and while I have Windows Explorer set to color code encrypted and
compressed files and folders, but these objects show no indicative color
coding. At a glance, it appears all encryption has been stripped of the
files.

But, if I pull up the file properties, they are clearly marked as
encrypted.

So here's my question:

Is it possible, that since I used alternate credentials to copy the
files from a laptop in one domain to an NTFS file system of a PC in
another
domain, the encryption was adjusted to reflect these alternate
credentials?
I've read some articles and that's my guess right now, but I haven't seen
anything definitive.

If I am understanding your explanation correctly, then you are right about
what is happening. The encrypted files were created on your Home Domain
with the SID of the alternate credentials. You could always test this by
creating another user account on the Home domain and trying to open the
encrypted files. Of course, the test account would have to have sufficient
privileges to open the files were they not encrypted.

carl