EFS and Domain Questions

  • Thread starter Thread starter JackGagliano
  • Start date Start date
J

JackGagliano

Hello All,

I have a Windows 2003 Standard server with a domain and multiple XP Pro
clients. I have done all the necessary steps on the domain controller
to enable user and computer certificates. I have viewed in the CA that
the computer accounts are automatically being enrolled and that the
enrollment from the users going to the https://certsrv is also in the
CA. All that being said, say I have two users, NA and TR. I want both
of them to be able to access an encrypted file. I have also made sure
that both their certificates are in their user object in AD. So here
is the scenario, I encrypt the file with NA and all goes fine, I go
back to that file and add on TR as another user that has access to it.
When I go to look at the file as TR it gives me an Access Denied error.
I have also gone as far as exporting the private keys and importing
them to both users. Nothing seems to work. We want to start
implementing EFS in our organization, but I'm at a loss of what to try
next.

Thanks in advance.

Jack Gagliano
Systems Support Analyst
Rocon Manufacturing Corp.
 
Where is the file located? If the file is locally stored on a computer
shared by the two users, then when you add the user, you must ensure
that the thumbprint of the certificate selected for each user matches
the actual certificate within the user's store that they use for EFS.

If the file is on a server, then things work much differently. In this
scenario, the server actually impersonates the user (assuming you are
using normal UNC paths), and then creates a profile, requesting either a
Basic EFS certificate, or generating a self-signed certificfate if the
Basic EFS template is not available.

You may want to look into credential roaming for WIndows XP. This was
just released (previously called DIMS). You can find some info at
http://technet2.microsoft.com/WindowsServer/en/Library/0d3cecd8-e971-
4ed3-95d3-adf35851fdc21033.mspx. This will allow the certificates to
roam between computers (not using roaming profiles)

Brian
 
Back
Top