MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

10-50 Chapter 10 Managing Data Storage
EFS is configured either from Windows Explorer or from the command line. It can be
enabled or disabled for a computer, domain, or organizational unit (OU) by resetting
recovery policy in the Group Policy console in Microsoft Management Console (MMC).
You can use EFS to encrypt and decrypt files on remote file servers but not to encrypt
data that is transferred over the network. Windows XP Professional provides network
protocols, such as Secure Sockets Layer (SSL) authentication, to encrypt data over the
network.
Table 10-4 lists the key features provided by Windows XP Professional EFS.
Table 10-4 EFS Features
Feature Description
Transparent encryption In EFS, file encryption does not require the file owner to decrypt and
re-encrypt the file on each use. Decryption and encryption happen
transparently on file reads and writes to disk.
Strong protection of
encryption keys
Integral data-recovery
system
Secure temporary and
paging files
Public key encryption resists all but the most sophisticated methods of
attack. Therefore, in EFS, the file encryption keys are encrypted by
using a public key from the user’s certificate. (Note that Windows XP
Professional and Windows 2000 use X.509 v3 certificates.) The list of
encrypted file encryption keys is stored with the encrypted file and is
unique to it. To decrypt the file encryption keys, the file owner supplies
a private key, which only he or she has.
If the owner’s private key is unavailable, the recovery agent can open
the file using his or her own private key. There can be more than one
recovery agent, each with a different public key, but at least one public
recovery key must be present on the system to encrypt a file.
Many applications create temporary files while you edit a document,
and these temporary files can be left unencrypted on the disk. On
computers running Windows XP Professional, EFS can be implemented
at the folder level, so any temporary copies of an encrypted
file are also encrypted, provided that all files are on NTFS volumes.
EFS resides in the Windows operating system kernel and uses the
nonpaged pool to store file encryption keys, ensuring that they are
never copied to the paging file.
Security Alert Even when you encrypt files, an intruder who accesses your computer can
access those files if your user account is still logged on to the computer. Be sure to lock your
console when you are not using the computer, or configure a screensaver to require a password
when the computer is activated. If the computer is configured to go to standby mode
when it is idle, you should require a password to bring the computer out of standby. These
precautions are particularly important on portable computers, which people are more likely to
leave unattended while the user is logged on.