Timeline for EFS encryption in Windows
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 8, 2015 at 16:23 | history | edited | PwdRsch | CC BY-SA 3.0 |
Corrected claim about password changes to account
|
| Dec 8, 2015 at 16:21 | comment | added | PwdRsch | Thanks for the correction @SilverlightFox. I was wrongly under the impression that there was a backup system key that could restore access to the user's keystore in the case of a password reset, but after some searching it looks like that requires the admin to make specific OS changes in advance. | |
| Dec 8, 2015 at 9:19 | comment | added | SilverlightFox | EFS doesn't work if you change the Windows password when not logged in (e.g. an attacker or another administrator user). Therefore you're protected in this scenario. | |
| Dec 7, 2015 at 21:50 | comment | added | nicoX | If you have multiple partitions—e.g. one for your data and one for your operating system—then choose the second option “Encrypt the whole drive. | |
| Dec 7, 2015 at 21:46 | comment | added | PwdRsch | @nicoX Correction: looks like you actually need Documents and Settings encrypted and may not need the Users directory. | |
| Dec 7, 2015 at 19:35 | comment | added | PwdRsch | @nicoX I'm not familiar with VeraCrypt so I don't know what limitations or impacts come with using that to encrypt different OS directories of a drive. If they say they support that configuration then you could give it a try. I believe you need to focus on using it to encrypt the Windows and Users directory/subdirectories to prevent someone from attacking Windows and accessing your EFS private key. | |
| Dec 7, 2015 at 19:05 | comment | added | nicoX |
Only the system partition, the system reserved, active, is encrypted on c: where Windows is, and not all that drive, this is what I assume, haven't proceeded with it actually yet... There is another option Encrypt the whole drive, this will encrypt all partition on my Windows disk, including Windows (recovery, sys), which I don't want. So I can go ahead with the first option Encrypt the Windows system partition right, this will ask for a password on boot, and this method as you said will not expose any Windows files, even though someone tries to extract files from the drive on another PC.
|
|
| Dec 7, 2015 at 16:54 | history | answered | PwdRsch | CC BY-SA 3.0 |