Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there anything wrong with encrypting the search index with EFS while letting the search service index encrypted files? I've encrypted the directory %ProgramData%\Microsoft\Search and I've added SYSTEM user by using "cipher /ADDUSER /certhash:"SYSTEMHASH" /s:thedirectory, and it looks like the SYSTEM account has no problem indexing my files.

However, the recommendation tells me to only index encrypted files when a full-disk encryption is used. Is this a wrong practice?

share|improve this question
@user110236: With EFS, in this particular case, the key cannot be entered, since LocalSystem does not log in interactively, therefore the EFS keys belonging to this system account are only obfuscated; they also are accessible by any Administrator as #2 says. With BitLocker, you always provide the decryption key before Windows can boot, so even though it doesn't protect against rogue Admins, it works fine against physical attacks by outsiders. – grawity Dec 19 '11 at 18:15
@grawity: You said, "With BitLocker, you always provide the decryption key before Windows can boot." I used the SysKey utility "to configure a start-up password that must be entered to decrypt the system key so that Windows can access the SAM database." Isn't that the same thing? – user110236 Dec 19 '11 at 19:05
up vote 4 down vote accepted

Read the reasoning for not just encrypting just the index in this TechNet page

Encrypting the Index To encrypt the index file itself, we recommend that you encrypt the entire volume containing the index with BitLocker or another 3rd party full-volume encryption option. This provides strong protection against offline attacks; online attacks are still possible by users with administrator access. BitLocker Drive Encryption provides enhanced protection against data theft by encrypting data operating system and data volumes. In Windows 7, BitLocker Drive Encryption works on removable drives. We strongly recommend also BitLocking operating system volumes if you BitLock data volumes.

While the Encrypting File System (EFS) can also be used, it is not recommended. The Windows Search service runs under the LocalSystem account and needs access to the index files. As a result, EFS keys associated with the LocalSystem account must be used to encrypt the index files. Consequently, the index files are open to the following attacks:

  • Online: Any administrative user can gain access to the encrypted index files by simply impersonating the LocalSystem account. (Existing tools on the web make this a trivial task.)

  • Offline: The key that is used by the LocalSystem account to decrypt files is stored on the machine in an obfuscated state. Someone with physical access to the machine can use existing tools on the web to retrieve this key and access the encrypted index files.

share|improve this answer
Thank you very much! I can't really upvote you for the lack of reputation though :/ – wbkang Feb 8 '10 at 0:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .