Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It seems that using EFS is pointless if someone else has access to your computer because of DRA... someone could easily enable the Administrator account set a DRA save the keys disable the Administrator account again or just make themselves a DRA if they are an Administrator so the next time you log in and start using your files the DRA certificate is added to the files.

EFS would protect you if your computer was stolen but it seems that EFS is used mainly for multi-user computers.

Because EFS is used to protect files from other users the Syskey utility doesn't do anything because they need to get past it as well.

So... is there a way to completely remove/block the ability to add a Data Recovery Agent to Windows 7 or maybe another solution to this issue?

share|improve this question
add comment

2 Answers

someone could easily enable the Administrator account set a DRA save the keys disable the Administrator account again

But to do that, they must have administrator rights themselves, so enabling the Administrator account would be pointless as they could make themselves a DRA.

In the end, if someone has physical access to the computer, they can get around any protection using even something as simple as a hardware keylogger to snatch your own password.

share|improve this answer
    
You don't need to be an administrator or even have an account you can enable the built-in administrator using a windows installation disk/repair disk. Having something like a keylogger is pointless when there is essentially one built in not exactly but it gives the same effect that being access to the files. I want to know how-to completely remove it. –  Arctor Apr 2 '11 at 17:12
add comment
up vote 0 down vote accepted

It seems the only way to have a multi-user computer and prevent the DRA from being enabled and used to gain access to another users files is to have all users as regular users and only one trusted person with the administrator account/password and then fully encrypt the OS drive and only allow that trusted administrator to start the computer and use hibernate when not in use.

I find it pretty ridiculous that to securely use EFS in a multi-user environment where it is very useful you need to use another encryption solution.

Yes the system could be compromised physically but when the main threat is a teenage script kiddie this is not that much of an issue as they are most likely not going to be able to afford a $50-80 keylogger and one of those is rather noticeable on a laptop.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.