G
Guest
I am trying to devise a plan whereby my client can safely use encrypting file
system (EFS). Mobile computer users benefit from encrypting sensitive files.
In the event the computer is stolen, the data does not enter the public
domain. When mobile users return to the home office, they can use NTBACKUP
to make backup copies of encrypted files, which remain encrypted in backup
form. Were the computer lost, a new computer would be provided and sensitive
files would be restored from backup (NTBACKUP). In order to be able to read
the files, the mobile user would be required to provide a certificate and an
associated private key. The point of my question has to do with the private
key, which I know how to export and import. When on the road, should the
mobile user always logon using his cached domain credentials so that the
private key matches the private key that he would have at the home office
when he is actually logged on to the domain? I assume that the user's
private key when logged on to the domain is different from the private key
that he has when he is logged on locally to his mobile computer. For
recovery purposes, I suppose, the corporate system administrator should
export the local logon private key and the domain logon private key of each
mobile user and vault them to ensure the keys are available for decrypting
backed up data. Is there some official Microsoft guidance on this?
system (EFS). Mobile computer users benefit from encrypting sensitive files.
In the event the computer is stolen, the data does not enter the public
domain. When mobile users return to the home office, they can use NTBACKUP
to make backup copies of encrypted files, which remain encrypted in backup
form. Were the computer lost, a new computer would be provided and sensitive
files would be restored from backup (NTBACKUP). In order to be able to read
the files, the mobile user would be required to provide a certificate and an
associated private key. The point of my question has to do with the private
key, which I know how to export and import. When on the road, should the
mobile user always logon using his cached domain credentials so that the
private key matches the private key that he would have at the home office
when he is actually logged on to the domain? I assume that the user's
private key when logged on to the domain is different from the private key
that he has when he is logged on locally to his mobile computer. For
recovery purposes, I suppose, the corporate system administrator should
export the local logon private key and the domain logon private key of each
mobile user and vault them to ensure the keys are available for decrypting
backed up data. Is there some official Microsoft guidance on this?