Is it possible to bypass NTFS encryption if the password used to encrypt the RSA key is a password to an AD account? So if an administrator can simply change your password, they would then be able to decrypt your files. My understanding of Encrypting File System is that the user's RSA private key is encrypted using a hash of the user's NTLM password hash plus the user name. If a domain admin can simply change the password, would this allow bypassing of Encrypting File System?
5
-
If the RSA key is encrypted with a hash based on the password, how is changing the password going to let it be decrypted afterwards?– userAug 4, 2020 at 14:14
-
Changing your password or having it reset doesn't lock you out of all your data, hence why i'm asking the question. There is obviously a difference between AD accounts and local accounts. Thanks– john doeAug 4, 2020 at 14:51
-
3Changing your password will re-encrypt the key. Having your password reset will make you lose access to your (user) encrypted data, it even gives lots of warning about it when you force a password reset in the user management tool.– userAug 4, 2020 at 16:29
-
If you want an accepted answer, go ahead and post that.– john doeAug 4, 2020 at 19:28
-
I'll write something up tomorrow if nobody else does. There's also an EFS data recovery agent (DRA) that can be set up to allow for recovery in the event of a AD user's lost password. If you have access to the DRA then you'll be able to access and decrypt the files, so password resets still don't do anything useful.– userAug 4, 2020 at 20:32
Add a comment
|
1 Answer
Under normal circumstances, changing the user password from an administrator account will result in the user's EFS encrypted files being lost. If the original password can be set back and the user's key is not changed, then the files can be decrypted again. This is true whether the user is an AD user or a local user, and the password is changed by using an AD/local administrator account.
For domains, it is possible to set up a Data Recovery Agent (DRA). This allows for the recovery of the decryption key if the original key becomes unusable. The DRA can be used to decrypt the files, so it's not necessary for an admin to change passwords to get to the data; they can just use the DRA's certificate to decrypt them.
The DRA could potentially be used to attack systems with automated password reset features. In the linked DRA page, there's a section on automated recovery of the encryption keys (for Azure Active Directory accounts). If an attacker can force a password reset to a known or chosen password, then they may be able to login with the new password and automatically recover the decryption key from Active Directory.
