WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Protecting User Data on Portable Computers

You can take the following steps to protect user data on portable computers in case of theft:

Encrypt all user data with EFS.

Configure the system key.

Secure the private key for recovery.

To provide EFS security for user data on a portable computer, do the following:

Make sure the user's My Documents folder is empty, and then apply EFS protection to this folder. Therefore, all new files that are stored in the EFS-protected folder are encrypted, and all new subfolders that are created in the EFS-protected folder are protected. Users can create as many folders in My Documents as they need. If you add encrypted files to the folder, the user cannot read those files.

Apply EFS protection for temporary folders that are used by applications. Applications work with only plaintext because EFS operates in the background. If EFS protection is not applied to the folders where the temporary files are stored, applications can save their temporary files as plaintext to the folders. You can also configure applications to store temporary files in EFS-protected folders.

Configure NTFS file system ACLs to prevent users from creating non-EFS-protected folders and from changing EFS settings.

Use the Windows 2000 System Key (SysKey) to protect EFS private keys. SysKey uses strong encryption techniques to increase the protection of users' protected stores, including users' private keys for EFS.

To configure system key protection

Type syskey at the command prompt. This brings up the dialog box shown in Figure 13.7.




Figure 13.7 System Key Dialog Box


After system key protection is enabled, it cannot be disabled.

If it is not already selected, click Encryption Enabled, and then click OK. After a reminder that you should create an updated emergency repair disk, you are presented with options for the Account Database Key as shown in Figure 13.8. The default option is a system-generated password that is stored locally.




Figure 13.8 Account Database Key Dialog Box


Select the system key option that you want, and then click OK.

Restart the computer.

When the system restarts, you might be prompted to enter the system key, depending on the key option you chose. Windows 2000 detects the first use of the system key and generates a new random password encryption key. The password encryption key is protected with the system key, and then all account password information is strongly encrypted.

At subsequent startups:

Windows 2000 obtains the system key, either from the locally stored key, the password entry, or insertion of a floppy disk, depending on the option you chose.

Windows 2000 uses the system key to decrypt the master protection key.

Windows 2000 uses the master protection key to derive the per-user account password encryption key that is then used to decrypt the password information in Active Directory or the local SAM registry key.

The syskey command can be used again later to change the system key storage option or to change the password.

Securing the Private Key For Recovery

It is recommended that you remove private keys for recovery agent accounts from the computers by exporting the keys to removable media and then putting the keys in locked storage. This should be done with the default recovery keys before any changes are made to recovery policy.

The Certificate Export wizard accomplishes this purpose. This wizard is available through the Certificates console. For more information about using the Certificates console and the Certificate Export wizard, see Windows 2000 Professional Help or Windows 2000 Server Help.

You must log on as Administrator, because the EFS recovery agent certificate is contained in the personal certificate store for the Administrator account. You can then use the Certificate Export wizard to export the certificate and private key to a removable medium. For information about how to export a certificate and its private key, see Certificates Help.

To delete the private key from the computer, you must select the Delete the private key if the export is successful check box on the Export File Format page of the wizard. When you have completed the wizard, the private key is deleted from the computer and the recovery agent certificate and private key resides in a .pfx file in the folder or drive that you have specified. Now you need to protect the .pfx file by putting it into secure storage.

To protect a .pfx file

If you created the .pfx file on a floppy disk, the file is right where it should be&8212;on a medium that can be physically removed and locked away in another location. If you did not create the .pfx file on a floppy disk, copy it to a floppy disk and delete it from your hard disk drive.

Remove the floppy disk and make a backup copy of the .pfx file on another floppy disk. Store both floppy disks in safes or in a secure place. One floppy disk should be stored in a secure offsite location.

You then can use the Certificates console to import the .pfx file to a recovery computer and perform recovery operations. After recovering encrypted files, secure the private key again.