Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Most of these operations on files and folders can be performed
regardless of the underlying disk filesystem. For example, if you
right-click on a folder, the same shortcut menu is displayed
regardless of whether the underlying partition or volume is formatted
using FAT, FAT32, or NTFS. Some tasks can be performed only on files
and folders located on NTFS volumes, as indicated in the following
descriptions.

Compress a File or Folder

Right-click on file or folder Properties General Advanced Compress contents

If you compress a folder, you



will
be prompted to choose between the following:

Apply changes to this folder only

Compresses the folder but doesn't compress any of
the files in the folder. However, if you copy existing uncompressed
files or save new files to this folder, they will be compressed
automatically.

Apply changes to this folder, subfolders, and files

Compresses the folder, all files within the folder, all subfolders
within the folder, and all files within these subfolders. Use this
option if you want to compress existing files within a folder.

To compress an entire drive, select the drive in Windows Explorer or
Disk Management and:

Right-click on drive Properties General Compress drive

To display compressed files and folders using an alternate color,
open My Computer or Windows Explorer and select:

Tools Folder Options View Display compressed files and folders with alternate color

Copy or Move a File or Folder

Copying or moving files within







or
between NTFS volumes can affect their NTFS permissions, compression
state, or encryption state.

Effect on NTFS Permissions

A file or folder inherits the NTFS permissions of its destination
folder when it is:

• Copied from one location to another within an NTFS volume

• Copied from one NTFS volume to another

• Moved from one NTFS volume to another

A file or folder retains its NTFS permissions when it is moved from
one location to another within an NTFS volume.

Finally, if you save a new file in a folder, the file inherits the
NTFS permissions assigned to the folder.

Effect on Compression State

The effect on the compression state is the same as the effect on NTFS
permissions.

Effect on Encryption State

The rules are different here:

• An unencrypted file or folder moved or copied to an encrypted folder
  becomes encrypted, whether the destination folder is on the same NTFS
  volume or not.

• An encrypted file or folder moved or copied to an unencrypted folder
  remains encrypted, whether the destination folder is on the same NTFS
  volume or not.

Finally, if you save a new file in an encrypted folder, the file is
saved as encrypted.

If you copy or move encrypted files and folders to a remote computer, your encryption certificate and private key must be available on the remote computer or you will not be able to decrypt them from the remote computer. To avoid this complicated process, decrypt files and folders prior to copying them over the network. Otherwise, you will have to export your certificate and key from the local computer as a .pfx file to a floppy disk and then import it into your personal store on the remote computer. The exception to this situation is if you have a roaming user profile configured on the network. In this case your encryption certificate and private key are stored on the file server where your profile is stored, and they are available from any machine you log on to.

Effect on Other Attributes

Other file and folder attributes, such as Read-only, Hidden, and so
on, aren't affected in this way but are always
retained whenever files are copied or moved.

Effect of Copy/Move to FAT/FAT32 Volumes

Copying or moving a file or folder from an NTFS volume to a FAT or
FAT32 volume causes the file or folder to lose its NTFS permissions,
become uncompressed, and be decrypted.

Customize a Folder

Select a folder in the left pane
of
Windows Explorer and:

Right-click on a blank spot in the right pane Customize This Folder

You can customize the folder's appearance, icons,
and other fun stuff.

Display Attributes of a File or Folder

Right-click on file or folder Properties General

On NTFS volumes,



additional
attributes are accessed using the Advanced button. You can modify
attributes of files and folders on remote computers as follows:

• If the remote file or folder is in a shared folder, open Windows
  Explorer or My Network Places to find the share, and open the
  properties sheet for the file or folder.

• If the remote file or folder is not in a shared folder, first map a
  network drive to the hidden share name for the root of the remote
  drive on which the file or folder resides. Then when the window for
  the mapped drive opens, open the properties sheet for the file or
  folder.

This works with every attribute except encryption.

Encrypt a File or Folder

To encrypt a file or folder



on
the local machine, open Windows Explorer and:

Right-click on file or folder Properties General Advanced Encrypt contents

If you encrypt a file, you will be prompted to choose between the
following:

Encrypt the file and the parent folder

This is the recommended choice, since files that are copied to or
saved in encrypted folders are automatically encrypted.

Encrypt the file only

By selecting "Always encrypt only the
file," you can make this the default choice.

If you encrypt a folder, you will be prompted to choose between the
following:

Apply changes to this folder only

Encrypts the folder but doesn't encrypt any of the
files in the folder. However, if you copy existing files or save new
files to this folder, they will be automatically encrypted.

Apply changes to this folder, subfolders, and files

Encrypts the folder, all files within the folder, all subfolders
within the folder, and all files within these subfolders. Use this
option if you want to encrypt existing files within a folder.

To encrypt a file or folder on a remote computer, first configure the
remote computer for file encryption by:

Active Directory Users and Computers right-click on server name Properties General Trust computer for delegation

Then open Windows Explorer on the local machine and:

Tools Map Network Drive select mapped drive right-click remote file or folder Properties General Advanced Encrypt contents to secure data

Decrypt an Encrypted File or Folder

To decrypt a file or folder that
was



previously encrypted:

Right-click on file or folder Properties General Advanced deselect Encrypt contents

Recover an Encrypted File or Folder

If you are a designated

recovery
agent (like the default Administrator account), then restore the
user's lost file or folder using the Backup utility
in System Tools under Accessories. Then use Windows Explorer to
decrypt the file or folder using the procedure just described and
return the unencrypted version to the user.

To guard against permanent data loss, a designated recovery agent
should back up the default recovery keys to a floppy as follows:

Start Run mmc add the Certificates snap-in My user account open the new console Personal Certificates right-click the file recovery certificate All Tasks Export

The wizard then exports the certificate and its associated private
key to floppy as a

.pfx file. If you want to
designate additional recovery agents for the local machine, do this:

Local Security Policy Public Key Policies right-click Encrypting File System Add Data Recovery Agent

To designate additional recovery agents for a domain, use Group
Policy. New to WS2003 is the fact that you can configure domains so
that recovery agents aren't requiredalso done
using Group Policy.

Modify a File Association

Each file is associated with a
default
application that is used to open it. Double-clicking on the file
opens the file using this program. To change the program that is
invoked when you open the file:

Right-click on file Properties General Change select application

Changing the file association for a file changes the association for
all files of the same type! For example, if you select a text file

Test .

txt and change its
associated program from Notepad to Paint, all files ending with

.txt will now invoke Microsoft Paint when you
try to open them!

Open a File or Folder

To open a file using its



default
application or open a folder to display its contents, either
double-click on it or:

Right-click on file or folder Open

If you want to open a file using a different program (for example, if
you want to open an

l file using Notepad),
do this:

Right-click on file or folder Open With

Secure a File or Folder

You can secure a file or



folder
using NTFS permissions (on NTFS volumes only, of course) by:

Right-click on file or folder Properties Security

See

Permissions later in this chapter for more
information.

Send a File or Folder

Right-click on file or folder Send To select destination

By default, there are four


choices you can Send To:

3

1 /

2 -inch Floppy

Copies the selected file or folder to a floppy disk.

Desktop

Creates a shortcut to the selected file or folder and places this
shortcut on the desktop so you can access the file or folder more
easily.

Mail Recipient

Attaches the selected file or folder to a new email message in
Microsoft Outlook Express and prompts you for the recipient. You
should configure your Internet email settings using the Internet
Connection Wizard before using this.

My Documents

Copies (doesn't move) the selected file or folder to
the

My Documents folder for the logged-on user.

There may be other Send To options available when WS2003-compliant
applications are installed. You can also create a custom Send To
option by editing your user profile (unless it is mandatory). To do
this, first open My Computer and go to:

Tools Folder Options View Show hidden files and folders

Then browse your profile to locate the

Send To
folder. For example, if you are logged on as Administrator, open the
folder

C:\Documents and
Settings\Administrator\SendTo , right-click, and create a
new shortcut to the program or location you want to send files or
folders to. For example, to Send To Notepad, create a
shortcut to

C:\Winnt\notepad.exe ; to Send To
the Pub share on

Server12 , create a
shortcut to

\\Server12\pub .

Share a File or Folder

See

Shared

Folders later in
this chapter for more information.

View Properties of a File or Folder

Right-click on a file or folder Properties