Encryption recuperation agent

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have tried hard to find the information I need to be ready to encrypt my
files on my laptop. I’m know able to do basic thing but not confident enough
to use it. The reason is that I have made test and it shows that my
comprehension is far from perfect.

Here is the case I try to solve:

- I have a home network (not a domain);
- Two of my pc have Xp pro installed (one is a laptop).


I want to encrypt the laptop folder “My documentsâ€. And, I want to be sure
that I can lost the Laptop (that will be bad) and restore the backup. I
think that a good strategy will be to create “recuperation agentâ€.

So I created a new account in my laptop and used it the following way:

1. I created a “recuperation agent certificates†with the cipher /r command;
2. I added the certificate to Security Strategy (My laptop is in French so
it might be named differently)
3. I encrypted a test file with my main user account;
4. I backed up the file with the XP backup utility;
5. I restored the file in a different folder with the recuperation agent
account;
6. Since the original file was in a private directory, I had to take the
ownership of the folder file;
7. I loaded the recuperation agent private keys.
7. And it works! I can read and decrypt the file.

So what is wrong! I made the same process but creating the “recuperation
agent†on my other PC. It works and I can add the certificate has a
recuperation agent in my laptop.

1. I created a “recuperation agent certificates†with the cipher /r command
on the "base PC";
2. I used the certificate to create a recovery agent on the laptop.
3. I encrypted a test file with my main user account;
4. I backed up the file with the XP backup utility;
5. I restored the file in the base PC with the recuperation agent account;
6. Since the original file was in a private directory, I had to take the
ownership of the folder file;
7. I loaded the recuperation agent private key on the base pc.

But when I try to access the file MyTest.txt then Notepad start and gives me
“access deniedâ€. That’s it, if you can help, I will appreciate.
 
You have to make sure that the Recovery Agent is defined on each computer
which I do via Local Security Policy/public key policies - Encrypting File
System and that must be done before you encrypt the file on the computer.
After a file is encrypted you can use efsinfo support tool or go to the file
properties/advanced -details to see if the file has a Recovery Agent and the
thumbprint of the RA certificate you make sure you are using the correct
one. You can logon as the RA to a computer that has the RA
certificate/private key and use the mmc snapin for certificates for user and
look in the personal folder to view the RA certificate. You can also use
rsop.msc on each computer to see if the Group Policy shows that the RA is in
effect. --- Steve
 
Back
Top