Home / server / Questions / 378792
In Process
Phil
Asked: 2012-04-13 01:13:44 +0800 CST

Group Policy Recovery Agent EFS not being used

  • 772

I am trying to get EFS working on our workstations. First when I tried to set a directory to be encrypted I got a warning about the Recovery Agent certificate being invalid.

It turned out that the default one set up when my domain was first set up many years ago had expired so I created a new one and added an "EFS Data Recovery Agent" to a GPO at Computer Configuration -> Policies -> Windows Settings -> Security Policies -> Public Key Policies -> Encrypting File System.

When I perform a "Group Policy Results" for a given workstation and user, it shows the new agent so its definitely in the Group Policy

Also, after running "gpupdate /force /wait:-1" and also waiting 24 hours! when I try and set a directory to be encrypted I no longer get the warning about an invalid Recovery Agent.

So far so good I thought. However, the Recovery agent is not being used which I have proved by

  1. backing up the removing the "user" EFS cert and just having the recovery agent certificate and private key imported - I get access denied when trying to read the file
  2. running cipher /c I get " No recovery certificate found."
  3. Drilling down through the properties of the file and the advanced encryption details, the list of recovery agents is blank.

Anyone got any ideas what is going on and how I get the recovery agent to be used?

group-policy encrypting-file-system

1 Answers

  1. I'm not exactly sure what is preventing the the DRA from being set on the file, but here is a breakdown of the EFS GPOs I have which may help you verify all the components are in place. Getting EFS set up is a pretty complex patchwork of components if you ask me.

    • Computer GPO for Recovery Policy. It sounds like you have this setup correctly with the certificate of your DRA. Do you have a certificate template defined on your CA that the is used for automatic EFS certificate requests?
    • Computer GPO to Disable Self-Signed certs. This disables in the registry the ability to use self-signed certs.
    • User GPO to Enable Cert Autoenrollment and Credential Roaming. Enable automatic enrolling of new certificates for the logged on user. Also, let the user's Cert and Keys roam with the user wherever he logs on.
    • User GPO to Encrypt folders. Logon script that runs cipher.exe as the user to encrypt his folders.

    This configuration assumes you are using Microsoft AD Certificate Services and not self-signed certs.

    • 1