MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

Lesson 4 Increasing Security by Using EFS
10-53
Security Alert The recovery agent can bring his or her private key to the owner’s computer,
but it is never a good security practice to copy a private key onto another computer.
It is a good security practice to rotate recovery agents. However, if the agent designation
changes, access to the file is denied. For this reason, you should keep recovery
certificates and private keys until all files that are encrypted with them have been
updated.
The person designated as the recovery agent has a special certificate and associated
private key that allow data recovery. To recover an encrypted file, the recovery agent
does the following:
■ Uses Backup or another backup tool to restore a user’s backup version of the
encrypted file or folder to the computer where his or her file recovery certificate
is located.
■ In Windows Explorer, opens the Properties dialog box for the file or folder, and in
the General tab, clicks Advanced.
■ Clears the Encrypt Contents To Secure Data check box.
■ Makes a backup version of the decrypted file or folder and returns the backup version
to the user.
Practice: Increasing Security by Using EFS
In this practice, you log on as an administrator and encrypt a folder and its files. You
then log on using a different user account, and attempt to open an encrypted file and
disable encryption on the encrypted file.
1. In Windows Explorer, create a folder named Secret on the C drive.
2. In the Secret folder, create a text file named SecretFile.txt.
3. Right-click the Secret folder, and then click Properties.
Windows XP Professional displays the Secret Properties dialog box with the General
tab active.
4. Click Advanced.
The Advanced Attributes dialog box appears.
5. Select the Encrypt Contents To Secure Data check box, and then click OK.
6. Click OK to close the Secret Properties dialog box.
The Confirm Attribute Change dialog box informs you that you are about to
encrypt a folder. You have two choices: You can encrypt only this folder, or you
can encrypt the folder and all subfolders and files in the folder.