1

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so forth. So, EFS works. However, he also wants the user to be prompted for their certificate password (the password generated when you first create the certificate) when:

  1. the user first logs in/accesses an encrypted file
  2. after a periodic time out when they go to access the file.
  3. if the user locks their screen.

I've configured a group policy to clear the cache every 240 minutes and when they lock their screen. However, it doesn't really seem to do what he's looking for. Is what he wants possible without using a second form of authentication (smart card, etc). If so, where am I messing up?

  • This is more of a Windows admin question than an Info Sec question. You might get better answers on the other sites? – schroeder Oct 29 '14 at 21:07
  • So, EFS works. However, he also wants the user to be prompted for their certificate password - Why? What type of attack does he think this would help in defending against? Making things pointlessly complex does not make the system more secure. – Zoredache Oct 29 '14 at 21:39
  • Hi, Thanks for the replies. As for the second: he's afraid of someone getting hit by a drive by attack which would expose sensitive data accessed via network share. I don't necessarily see the point in being worried about that. Let's say it's possible (which I'm beginning to doubt), and someone gets compromised. Whats to install some nefarious type from installing a keylogger, getting the password for the cert and exporting the cert? – Brian McElraft Oct 30 '14 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.