i need to encrypt a folder on windows but how to prevent domain admin from reading this folder when i input the key to decrypt that folder?

Question

well i searched the site for software that encrypt folders on the harddisk and i found recommendation for TrueCrypt or similar products.
but the thing i wanted to know is that if i open a file on the encrypted Folder then will be the domain admin able to access my files on that encrypted folder using the default windows shares "\PCName\x$\" ? since the files are now unencrypted to any windows process. or i am wrong with my thoughts ?
the problem actually is that i want to keep private files on work machine with reserving my privacy and denying the admin from seeing my private files.

Answer 1

If you do not trust a machine (and/or it's admin) then simply do not access anything you do not want to reveal - encrypted or otherwise.

Whatever method you use to encrypt/decrypt must make the file contents available to the machine (obviously, that's the point of decrypting it), and so also it's processes and the admin.

You might also be giving away the encryption key and password, so could reduce the security of everything you've got encrypted on that machine, not just the files that you open.

That said, you can store encrypted material in an untrusted location, as long as you do not decrypt it in an untrusted location.

Answer 2

Yes, if you connect a drive to a computer, the domain admin will be able to see your files. The domain admin is trusted with access to anything the computer currently has access to. If you don't trust the computer administrator, don't trust the computer.

However, I find it unlikely the system administrator will be waiting for you to connect a drive so he can make a copy of all your personal files. As long as you unmount a TrueCrypt volume when you're not using it, you're probably reasonably safe. Once it's unmounted, someone could only access it again if they had your volume's password (perhaps there is a keylogger on the computer).

Why are you worried about this? Assuming this is a computer and network owned by a business you work for, I think the two most common reasons would be:

1. You do not trust your system administrator. This is a concern perhaps you want to address with management. Since the system administrator often can access nearly anything in the company, if you have reason to believe they are not trustworthy, management should know about it.

2. You are doing something clandestinely and are afraid of getting caught. You should be! If your workplace does not want you using their time and their resources for some activity, don't do it.

The only way to ensure the system administrator cannot access your files is to access them from a computer outside of his/her control. Perhaps bring a laptop with you and access the files from that machine.