Encrypting a folder on Server 2008

Dear Experts,

I am trying to create an encrypted folder on our server that will be accessible to only a few users.  When I tried to encrypt it, I got the "EFS recovery policy contains invalid recovery certificate" error, so I started to follow the instructions how to export then import the EFS private certificate.  Now I am getting an error that says "Windows cannot determine if this certificate has been revoked......" error.  If I go ahead and install this certificate anyway, the Recovery agents gets labeled UNKNOWN_USER.
The server I am trying to install the recovery agent is not the domain controller, so I exported the EFS certificate from the domain controller, then moved it to this file server.  I am not sure if this is the correct method.  Also, the certificate I exported had the expiration date that is in the past, so I am very confused.
Please advise.
yballanAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
Advertise Here
 
btanConnect With a Mentor Exec ConsultantCommented:
Client computers cannot encrypt any new documents until a valid recovery agent certificate is available.. also MS advised the cause as "The Encrypting File System (EFS) recovery policy that is implemented on this computer contains one or more EFS recovery agent certificates that have expired. These certificates cannot be used."

Check out the steps in handling this error http://support.microsoft.com/kb/937536

Also other aspects - either renew the existing certificates or generate new certificates for the EFS recovery agents and reapply the recovery agent policy with those certificates. E.g.
Renewing certificates - http://technet.microsoft.com/en-us/library/cc738405(v=ws.10).aspx
Requesting certificates - http://technet.microsoft.com/en-us/library/cc778348(v=ws.10).aspx
0
 
btanExec ConsultantCommented:
This looks like a similar case to this discussion
From the description, this certificate should be a self-signed one. You can verify this in the certificate console: The name under Issued To is as same the one under Issued By if it is a self-signed certificate
we can still decrypt files even though the EFS certificate is expired, because EFS stores existing private keys. As a result, I suspect that issue results from one of the following causes:
 
·         The private key corresponds to the certificate is damaged or deleted.
·         The thumbprint listed in Users Who Can Access This File does not match any thumbprints for the user’s certificates.
 
If any of the above factor is true, I am afraid that we may not be able to recover the data.
https://social.technet.microsoft.com/Forums/windows/en-US/3820fcc9-1fff-4c69-8f28-a54c935aaf60/i-cant-create-install-a-recovery-certificate-for-encrypted-files-help-needed?forum=itprovistasecurity

You can also use efsinfo to view thumbprints to help match up the certificates that are RA. You need to have
a RA export their recovery certificate and private key to a .pfx file.
http://support.microsoft.com/kb/243026

By default, the Administrator account has this certificate and is configured as the data recovery agent. If you are running your computers in a Windows domain, then the default Recovery Agent will be the Administrator account on the first domain controller you installed in your Windows domain. Kindly also see the best practices
http://support.microsoft.com/KB/223316
0
 
yballanAuthor Commented:
Dear btan,

Thank you for your reply, yes, I believe it is the same sort of issue.  I have read the threads, and am doing the same exact thing, but the results do not seem to be the same.
Since I am trying to encrypt a folder on our file server, I decided to test this out on my private PC first, so not to mess up the server with errors.
Please correct me if I am going about this the wrong way:
1.  I generate the recovery certificate on my PC and save them on a USB drive. (cipher creates .CER and .PFX files with no error.)
2.  Then I install these, by going through certificate import wizard.  Again, no error.
3.  I go to encrypt a test folder in my Document folder, and when I apply, I get "An error occurred applying attributes to the file:  c:\Users\xxx\yyyy    Recovery policy configured for this system contains invalid recovery certificate."

What am I doing wrong?
0
 
yballanAuthor Commented:
Dear btan,
Thank you for pointing out the steps!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.