لطفا منتظر باشید ...
Hack 11 Disable EFS
While the Encrypted File System of Windows
2000/XP can be useful for protecting data, your best approach might
actually be to disable it.
The Encrypted File System (EFS) feature was first introduced in
Windows 2000 and is also available in Windows XP Professional. EFS
provides a much higher level of security than the one offered by NTFS
alone, which can be circumvented without much effort as long as
physical access to the computer is allowed. EFS is extremely easy to
use and is available without any special configuration because it is
enabled by default. Even though it seems that with all these
advantages EFS should quickly find its place in
everyone's environment, implementating it properly
is a fairly complex task.
The Problem
Your two primary concerns are the ability to recover encrypted files
and the protection of private keys used for encryption, which are
associated with each user's account and the recovery
agent's account. Recovery of encrypted files might
be a fairly common occurrence. Because the private keys necessary for
decryption are stored in the user's profile, if the
profile gets deleted or corrupted, the user can no longer access
their encrypted files. The process of recovery involves simply
logging on as an account that is designated as a data recovery agent.
By default, this account is a local administrator on a standalone
computer and a domain administrator in a domain environment. Because
the private keys for data recovery agents are also stored as part of
their profiles, it is recommended that private keys for data recovery
agents should be exported from the computer that contains them and
stored in a secure place until a recovery needs to be performed.
Currently, without using any custom solution, backup and storage of a
user's private keys (without backing up the entire
profile) tends to be a time-consuming process. In addition, using
nondefault recovery agents (which is the recommended procedure)
requires installation of the Certificate Authority feature, which
also needs to be managed properly. If you are not ready to handle all
these additional tasks, your best bet might simply be to temporarily
disable EFS on users' machines.
The Solution
In the Windows 2000 domain environment, launch the Group Policy MMC
snap-in and select the Group Policy Object (GPO) linked to your
domain. Then, drill down to Computer
Configuration
WindowsSettings
Security SettingsPublicKey Policies
Encrypted Data Recovery Agents,right-click on the folder labeled Encrypted Data Recovery Agents, and
select Delete Policy to delete the default recovery policy. Then,
right-click on Encrypted Data Recovery Agents again and select
Initialize Empty Policy. This will remove users'
ability to use EFS on any Windows 2000 system that belongs to the
domain. In absence of EFS recovery agent, Windows 2000 clients will
refuse to encrypt any files or folders.
However, you might be in for a surprise if you try to use the same
approach in Windows XP, because Microsoft changed the default EFS
behavior to allow a Windows XP client to use encryption even if no
Data Recovery Agent is available (the same is true for Windows Server
2003). Fortunately, there are several new ways of preventing this,
which we'll look at now.
Disabling EFS for a file
Windows XP offers greater flexibility in configuring the scope of
reach of EFS. If your
intention is to disable EFS for a
single file, you can simply assign the system attribute to the file.
Although this is not the most elegant solution, it does provide a
quick workaround. In order to apply the system attribute to a file,
use the attrib command with +s
parameter. For example, to apply the system attribute to the
info1.txt file, type the following at the
command prompt:
attrib +s info1.txt
Disabling EFS for a folder
If you instead want to prevent EFS on the folder
level, you can create a desktop.ini file in the
folder. The desktop.ini file should contain the
following two lines:
[Encryption]
Disable=1
This will affect the folder itself and all of its files. However, it
does not have any impact on its subfolders and their content.
Disabling EFS for a system
Finally, if you prefer, you can disable EFS on the system level. This
can be accomplished by editing the Registry. Set the following entry
of DWORD type to the value 1:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS\EfsConfiguration
It is easier, however, to use Group Policy for this purpose. Start by
launching Local Security Policy from the Administrative Tools menu.
Next, double-click on the Public Key Policies folder. You will see a
subfolder named Encrypting File System. Right-click on it and select
Properties from the context-sensitive menu. You will notice a
checkbox labeled "Allow users to encrypt files using
Encrypting File System (EFS)," as shown in Figure 1-13.
Figure 1-13. Disabling EFS in Windows XP/2003
Unchecking this box will disable EFS altogether on the system. Note
that this setting can be also used to together with Group Policy to
disable EFS for all computers residing in any of Active Directory
containerssites, domains, or organizational units.
Marcin Policht
