If I understood correctly, when I enable NTFS encryption (EFS) for a specific folder in Windows, it uses specific account's user name/password (salted) to create asymmetric keys for data encryption and decryption. If I enable encryption for a certain folder, I presume this means that other system accounts (like
NetworkService) won't be able to access contents of this folder.
How does this work if you enable encryption for the entire drive? I.e. how are Windows services able to use the disk at all in this case?
The reason I am asking is that I would like to enable encryption on a certain folder containing deployed executables for several applications (a service, a gui console, some command line tools, etc.), so I'd like to understand exactly how I will need to configure all this to work.
To clarify, we have a server located at a remote location, and we would like to protect our installed software from copying or disassembly. The server is running some services which receive data from devices and store them around, and it has a web app for visualization. Login is protected by a rather strong password, but this doesn't stop anyone from pulling out the disks and making a copy.
If EFS suitable for this? Or should we take a different approach?