EFS Not Working as It Should

[jcastillop]

I'm doing some testing with EFS but I cannot get it to work correctly. I'm stumped, because in theory, from what I read, encrypting and selecting users who can decrypt is a pretty basic process.

Our Certification Authority is installed on one of our Windows 2003 Domain Controllers.

I encrypt a file on another W2003 Server, and select the users who can decrypt it (these users have previously requested EFS or USER certificates using the CA's web interface).

I setup a share, so the file can be accessed over the network, and assign full permissions for both the share and NTFS Security for the users in questión.

However, when these users try to open the file, they get the "Access Denied" message.

On the other hand, I have found that it works if I do the following:

A user who has not requested a certificate from the CA encrypts a file on the server (this automatically generates an EFS certificate for the user). If I now give this user decryption permissions for my file, they are able to open it with no problem. HOWEVER, if I encrypt a file on another server, and give this user decrypt permissions, they also get the "access denied" message when they try to open that file.

I don't think it's supposed to work this way!!!! Because it would mean that before users can be assigned decryption permissions, they will firstly have to encrypt one of their own files on that same server!!!

Does anyone have any clue as to what I'm leaving out? like I said.. I am completely stumped with this one.

Thanks in advance for your help

 

[aftertaf]

how did you configure your CA? as a stand alone CA?

seems the certificates are being stored on a machine per machine basis...

do any/all users have roaming profiles?

Aftertaf

"Resolve is never stronger than the night before it was never weaker

 

[jcastillop]

The CA was configured as a stand alone CA (I'm assuming this because it has issued it's own CA certificate). It is also the only CA in the Domain.

The users do not have roaming profiles.

Thanks for helping out.

 

[aftertaf]

if its stand alone then this means it isnt integrated into AD, i think...
learned about this for my MCP, but seems a long time ago now (1 year )

i think you may have to import the certificates into the store on the file servers, or something along those lines..
google for stand alone CA and active directory, should put you on the right track

Aftertaf

"Resolve is never stronger than the night before it was never weaker

 

[jcastillop]

aftertaf,

now I'm thinking it's not a stand alone CA or not... is there anyway I can check?

 

[jcastillop]

OK, it's not a stand alone, we have configured to automatically issued certificates... I understand this cannot be done with stand alone CA's, the administrator must review and approve the request.

 

[aftertaf]

its something ive never done, jst learned about... and still am learning.

pain i cant set up a playmobil domain to tinker with!!!

they will firstly have to encrypt one of their own files on that same server!!!

this is what imports their certificate into the file server's store!!! i think.

any luck?

Aftertaf

"Resolve is never stronger than the night before it was never weaker

 

[ecunupe]

My question is when you chose to encrypt the folder did you look at the details tab beside the encryption folder and add the users there. This is another check that is added into the system.

http://www.msdn.microsoft.com/libra...ecure/html/WinNETSrvr-EncryptedFileSystem.asp