Windows 10: Windows EFS Issues

Hey Everyone!

I'm having quite a bit of trouble with Windows EFS encrypted files currently. I recently migrated backup systems for the server, found that the backups are completing with errors, and those particular files are encrypted through EFS. I was able to decrypt a majority of them because the one user that (maybe unknowingly) encrypted these files was still in active directory.

Unfortunately, the other two users that have encrypted files are no longer in AD. I can't simply take control of the file through permissions and decrypt it because of the certificates assigned to the old users. I can't export the old user private keys because they weren't set up with the function to export by the previous tech. The certs are still in the server, so I'm unsure if they can be leveraged at all?

I've tried (not really thinking it would work) recreating the old user account to see if maybe the naming convention was enough to trick Windows - but no luck. So I think I have two options potentially, figuring out a way to assign the old certs to another user (which I'm unsure is possible without the private keys), or figure out how to utilize the admin recovery cert.

The admin account was assigned a recovery cert, and that admin account is still in play. Maybe I'm not googling the right terms, but I can't find any way to actually decrypt the file using the recovery cert instead of the user cert that encrypted the file. I tried signing into the admin account and decrypting the files like normal, but I get access denied. I've tried decrypting them through cipher on the cmd, access denied. I've tried adding additional certs to the files/folders (including the admin cert), yet again access denied.

Any suggestions? Thanks a bunch in advance!

The server is running Windows Server 2012 R2 Version 6.3 (Build 9600)

:)

 

Win 10 pro EFS Encrypting File System Problem (Dell)

Hi,

Thank you for being a part of Windows 10.

I appreciate you for providing details about the issue and we are happy to help you.

I suggest you to start the Encrypting File System (EFS) Service and check if it helps.

Follow the below steps:

• Press Windows key + R from the Keyboard.
• Type services.msc and hit Enter.
• Search for Encrypting File System (EFS) Service.
• Double click on Encrypting File System (EFS) Service and click on
  Start button.
• Click on the dropdown list and set the Startup type to
  Automatic.

If the issue still persists then, I suggest you to post the same question in TechNet forum for further assistance with this issue. Follow the below link to post your question in TechNet forum.

Technet forums

Kindly let us know if you need any further assistance with Windows. We are glad to assist you.

Thank you.

 

EFS in Windows 10 after reinstall

Try this Step by Step Guide to EFS Recovery

http://blog.windowsserversecurity.com/2015/01/2...

There's an email address provided to contact the Author

Related Windws 7 thread

https://social.technet.microsoft.com/forums/win...

If still experiencing issues, repost your request to TechNet IT Pro forum.

https://social.technet.microsoft.com/forums/en-...

 

How find Private key of EFS?

Hi VijayKumhar,

Thank you for posting your question in the Microsoft Community Forums.

I appreciate your efforts to work on this issue.

Follow these steps to back up the private key using the Command Prompt as the option ‘export the private key’ is not available.

1. Open CMD or Command Prompt in Admin mode.
   
2. Type ‘cipher /x "%UserProfile%\Desktop\EFSCertificates".
   
3. You will now get a prompt confirming if you are sure if you want to back up the certificates associated to your files encrypted with EFS Encryption. Click on OK.
   
4. It will work as you to enter a password to protect your .PRX file from unauthorized users. Enter the password and hit Enter.
   
5. Now, enter the same password to confirm it and then hit Enter.
   

Once this is done, a file by name ‘EFSCertificates.PRX’ will be saved on to your Desktop.

Further, if you still face issues, suggest you to post your question in the
TechNet Windows 10 IT Pro Security where we have support professionals who are
well equipped with the knowledge and skill to handle queries regarding EFS Certificates issue.

We look forward for your response.

Regards,

Srimadhwa B

Microsoft Community-Moderator