Prevent EFS files from showing up in file share

Sorry, the FAT example was merely to illustrate that silent decryption of EFS encrypted files when moved was possible - I'm certainly not intending to make the file servers FAT based!

I had a look at the group EFS when this all began, but it's clunky and hard work - frankly unmanageable for us given the rate some of the departments add and remove temps, contractors, etc.

More over, I'd simply also like to avoid EFS encryption being used on the file server as it makes recovery by IT staff tiresome, as we have to fetch the DRA key, import, decrypt, etc and makes backups difficult.

Is there really no setting, registry key, policy object, etc, that can be set to simply deny the use of EFS on certain disks, folders, shares, etc?

This is a setting that configured via the file system and thus it can't be stopped on just one machine.

Brian

I've just followed the guide from here:

http://www.petri.co.il/disable_efs_in_windows_xp_2003.htm

And it seems to do the job - make a local policy object that disables EFS and as such can be done on a machine by machine basis.

I must confess, I've not tried this on the file servers yet - just a spare work station running XP - but it's almost exactly what I want. Copy an EFS encrypted file over the network to a file share and it loses its encryption. The only hitch is you currently get a warning that it is going to be unencrypted but you can click "Ignore All" to silence that.

Any thoughts on why I shouldn't apply this to the files servers? Any ideas on suppressing that warning?

If this is done then I would be careful that users don't move the files or folders.  When that happens they will lose the encryption on their local machines.  As long as they copy it to this machien with this policy it seems OK.

Brian

Sorry, I don't follow, I understand that moving from the EFS laptop to the file server will remove encryption - that's ideal (to allow group sharing).

But, moving from the file server back to an EFS encrypted laptop will receive the local policy (EFS allowed) and obey the parent folder's NTFS settings (EFS on). So the files will be re-encrypted - also ideal (to keep data that leaves the building encrypted).

No?

You are correct.  I just wanted to make sure that is what you wanted.  It will lose it's encryption when copied to the server and when moved back to the laptop the local EFS policy will kick in and encrypt it.

Brian