Encrypting a folder on Server 2008

Posted on 2014-12-11
Last Modified: 2014-12-17
Dear Experts,

I am trying to create an encrypted folder on our server that will be accessible to only a few users.  When I tried to encrypt it, I got the "EFS recovery policy contains invalid recovery certificate" error, so I started to follow the instructions how to export then import the EFS private certificate.  Now I am getting an error that says "Windows cannot determine if this certificate has been revoked......" error.  If I go ahead and install this certificate anyway, the Recovery agents gets labeled UNKNOWN_USER.
The server I am trying to install the recovery agent is not the domain controller, so I exported the EFS certificate from the domain controller, then moved it to this file server.  I am not sure if this is the correct method.  Also, the certificate I exported had the expiration date that is in the past, so I am very confused.
Please advise.
Question by:yballan
  • 2
  • 2
LVL 61

Expert Comment

Comment Utility
This looks like a similar case to this discussion
From the description, this certificate should be a self-signed one. You can verify this in the certificate console: The name under Issued To is as same the one under Issued By if it is a self-signed certificate
we can still decrypt files even though the EFS certificate is expired, because EFS stores existing private keys. As a result, I suspect that issue results from one of the following causes:
·         The private key corresponds to the certificate is damaged or deleted.
·         The thumbprint listed in Users Who Can Access This File does not match any thumbprints for the user’s certificates.
If any of the above factor is true, I am afraid that we may not be able to recover the data.

You can also use efsinfo to view thumbprints to help match up the certificates that are RA. You need to have
a RA export their recovery certificate and private key to a .pfx file.

By default, the Administrator account has this certificate and is configured as the data recovery agent. If you are running your computers in a Windows domain, then the default Recovery Agent will be the Administrator account on the first domain controller you installed in your Windows domain. Kindly also see the best practices

Author Comment

Comment Utility
Dear btan,

Thank you for your reply, yes, I believe it is the same sort of issue.  I have read the threads, and am doing the same exact thing, but the results do not seem to be the same.
Since I am trying to encrypt a folder on our file server, I decided to test this out on my private PC first, so not to mess up the server with errors.
Please correct me if I am going about this the wrong way:
1.  I generate the recovery certificate on my PC and save them on a USB drive. (cipher creates .CER and .PFX files with no error.)
2.  Then I install these, by going through certificate import wizard.  Again, no error.
3.  I go to encrypt a test folder in my Document folder, and when I apply, I get "An error occurred applying attributes to the file:  c:\Users\xxx\yyyy    Recovery policy configured for this system contains invalid recovery certificate."

What am I doing wrong?
LVL 61

Accepted Solution

btan earned 500 total points
Comment Utility
Client computers cannot encrypt any new documents until a valid recovery agent certificate is available.. also MS advised the cause as "The Encrypting File System (EFS) recovery policy that is implemented on this computer contains one or more EFS recovery agent certificates that have expired. These certificates cannot be used."

Check out the steps in handling this error

Also other aspects - either renew the existing certificates or generate new certificates for the EFS recovery agents and reapply the recovery agent policy with those certificates. E.g.
Renewing certificates -
Requesting certificates -

Author Closing Comment

Comment Utility
Dear btan,
Thank you for pointing out the steps!

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

In this era, as you know, cybercrime and other sorts of frauds using the internet has increased day by day. We should protect our information assets and confidential information from getting exploiting by the attacker or intruders. Most of the fraud…
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
This video discusses moving either the default database or any database to a new volume.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now