up vote 0 down vote favorite
share [g+] share [fb]

What files can/cannot be encrypted with Windows 7 EFS? I am playing around with it in a VM and it seems the only files I cannot encrypt are the files under C:\Windows and files that are currently in use.

Am I missing something or can pretty much the entire drive and all new files outside of C:\Windows be encrypted?

Are there any reasons I should not encrypt everything? (Single User Computer)

What are the files/folders that should be encrypted? %Temp% etc...

Edit: Full disk encryption is not an option so please don't suggest it.

link|improve this question
100% accept rate
feedback

3 Answers

up vote 2 down vote accepted

According to the Win7 Resource kit: "EFS cannot be used to encrypt system files"

And from TechNet:

System folders cannot be marked for encryption. EFS keys aren't available during the boot process; thus, if system files were encrypted, the system file couldn't boot. To prevent other folders being marked for encryption, you can mark them as system folders. If this isn't possible, then a method to prevent encryption within a folder is defined in "Encrypting File System."

\\Greg

link|improve this answer
feedback
up vote 1 down vote

EFS may have that limitation. if you want to encrypt everything, try Bitlocker (or truecrypt)

\\Greg

link|improve this answer
Theoretically, you should be able to encrypt everything for which your account has write access. That said, it could cause problems for other users who don't have the decryption key. :-) – afrazier Apr 18 '11 at 20:38
@uSlackr your answer doesn't make much sense... "EFS may have that limitation" and use something else doesn't relate to my question at all. – Arctor Apr 18 '11 at 20:41
@jb48394: The answer makes perfect sense. @uSlackr is merely suggesting you use something designed to do what it seems like you want (encrypt everything) rather than try to bodge something else (EFS) into doing a job it wasn't designed to do. – afrazier Apr 18 '11 at 21:04
@afrazier read my question(s) again and read his answer.... I am asking about EFS not other solutions. You state I should theoretically be able to which is not really an answer either. – Arctor Apr 19 '11 at 0:22
1  
@jb48394: That's because you're not supposed to use EFS for that. EFS is for encrypting single files (or collections of files) that only users with the appropriate decryption keys (normally, you and any configured recovery agents) can decrypt. If there's no RA, and system accounts lack decryption keys, things might break in weird ways when TrustedInstaller can't patch files in C:\Program Files, or System can't read random items in C:\ProgramData, or any of another bazillion scenarios. If you want to encrypt everything on the computer, use the right tool for the job: FDE. – afrazier Apr 19 '11 at 13:51
show 2 more comments
feedback
up vote -1 down vote

Don't ever use EFS unless you really know what you are doing!

If you do use it, make sure you have all your private certificates backed up in a secure place other than the machine you are using. It might become very problematic to recover your files if you loose your certificate or if they expire.

Using EFS is asking for trouble. If you reinstall the system or loose the certs for some other reason, you can say goodbye to your files.

You have been warned.

The other solutions mentioned above are much better and saner.

link|improve this answer
@ccpizza This also has nothing to do with my question... TrueCrypt and BitLocker are also very dangerous to use if not more because if the system becomes corrupted and you don't have the Truecrypt rescue disk or one of the recovery methods to recover bitlocker in place you lose everything. – Arctor Apr 18 '11 at 21:58
@jb48394 - EFS is generally considered to be less forgiving than the alternatives others have listed. @afrazier has pointed out EFS should do what you want, and the others have listed why you might not want to and provided alternatives. – Rory Alsop Apr 18 '11 at 22:05
1  
Any encryption system requires you to backup the encryption key. This is in no way specific to EFS. – grawity Apr 19 '11 at 14:21
@grawity: EFS has tended to be much more dangerous than other options though because it was so easy to encrypt files/folders from the system's context menu without any configuration or warnings, that many users did exactly that and ended up unable to read their data after some event or another. – afrazier Apr 19 '11 at 16:53
@afrazier: Windows 7 now nags you to backup the encryption key. – grawity Apr 19 '11 at 18:49
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.