1

Windows (10) Professional users on NTFS-formatted drives can benefit from a built-in security option in the context menu to encrypt files and folders, it's called EFS. This would be much more comfortable and elegant than any third party encryption software, which installs additional software, opens unneccessary application windows and shows encrypted folders not as folders, but as drives in new pop-up Windows Explorer windows instead (like e.g. Cryptomator does). Plus such a specifically installed encryption software might raise a flag all by itself. And Windows Bitlocker, on the other hand, "only" encrypts whole drives and partitions, but how should I know beforehand how big that drive or rather partition should be(come) in light of limited SSD memory?

So I'd prefer Window's built-in EFS encryption of single folders with flexible, dynamic sizes. The only problem with Microsoft's EFS encryption is that it's useless if someone else but yourself gets access to your Windows profile, because this very user can simply open (and change) the encrypted files and folders just like yourself and without the need of entering a password, as long as (s)he just uses the same user account (which can't be avoided under all thinkable circumstances). I tried the command line cipher /k command to issue another EFS password (that no other person using my Windows profile knows), but this doesn't seem to work this way?

But I've also read that under some circumstances, like when an administrator changes a user's (my?) password (I'm my own administrator), the (original) Windows profile user (me) loses access to his/her EFS-encrypted files, but if that user had created a recovery key before, (s)he should nevertheless retain access to the files. Maybe I could also somehow play along Microsoft's strange EFS game rules and create another user account and activate EFS encryption there (so that an adversary with access to my own Windows profile would have no access to (actually but then not officially) my own files, but how could I avoid having the same problem as the adversary then)? Maybe somehow through shared folder access rights with my 'accomplice' user? I'm not sure.

I just can't think of a smart, simple way to put this into practice so that I can quicly add confidential files on the go to an EFS-encrypted folder in my own Windows profile, but in a way that only myself and not e.g. my boss who (hypothetically) also has access to my Windows profile has access. Just like encryption was meant to work. Can you? :-)

8
  • You are aware that if the computer is connected to a domain, then an administrator on the account can prevent the use of EFS and BitLocker, or require the use of it and make it so the certificates are accessible to a domain administrator also. Why are you putting personal confidential files on a machine accessible by your boss on a work computer? Why don't you use removable storage device, encrypt the drive, and store the files there. When the files don't need to be accessed they can be kept on your person. However, that can easily be prevent, by not allowing removable storage on a domain
    – Ramhound
    Feb 8, 2021 at 14:43
  • If you go the route of EFS be sure you backup the certificate, otherwise if anyone resets your password, you will lose access to the files that are encrypted. The certificate is the only way to decrypt the password, and performing a password reset (not a password change), will disable access to those files if you don't have the certificate and the password to that certificate.
    – Ramhound
    Feb 8, 2021 at 14:49
  • Thank you for the quick answer. And sorry for the confusion about the boss, I think I mentioned he is hypothetical :-) This is my own private PC and I can create different users and/or administrators for myself. However, I'm concerned that an adversary (or my partner or whoever) finds my PC when I'm logged in and will be able to read my EFS "protected" data (and Bitlocker unfortunately only protects drives >=30GB, no individual files or folders). So my best guess was to add to EFS protection an additional layer of security like logging off and on again with a different user, ...
    – TantoMano
    Feb 8, 2021 at 17:11
  • ...EFS-encrypting my data there, logging back on with my original user. I'm aware that I would no longer be able to access my own files under my original account this way, except if I have the certificate to restore access, right? However, that would be cumbersome on a daily basis, right? So what do you think of instead transferring ownership of the folder in question to another administrator user (of myself)...
    – TantoMano
    Feb 8, 2021 at 17:11
  • 1
    Rather than simply reposting the same question you can edit your existing question to clarify things.
    – Mokubai
    Feb 9, 2021 at 14:14

1 Answer 1

1

I imported the EFS certificate into my default user account to regain access.

It's not enough to import just the certificate, you have to import the corresponding private key as well. Make sure that you've selected "Export private key" and received a .pfx (or .p12) file, not just a .cer or .crt file.

Your certmgr.msc should show "You have a private key" after importing.

Note that EFS supports encrypting the same file with multiple users' certificates at once. The "guardian" user can add your certificate to some files either through the Properties dialog, or through cipher /adduser, and then you'll become able to read the files using your own keypair.

When trying to export/import the certificate I saw an option like "Very secure — promt for password when opening", just it didn't work

These options will not work for EFS, because the certificates are accessed by the filesystem driver, which is unable to prompt for confirmation. Only regular apps which use certificates for authentication or encryption (e.g. browsers) can make use of these security prompts.

And possibly in an easier way than I described, e.g. like transferring access to another (administrator?) user of mine which subsequently requires other users to enter a password to open if that's possible way to go?

You could do this by launching the specific application – text editor or file manager – as the guardian user, while still being logged in to your main account. This can be done using runas (or the "Run as different user" option that appears after Shift+rightclick).

For example, if you use runas /user:guardian notepad and input the password, then that Notepad instance will be able to access the protected files but the rest of your desktop will not.

enter image description here

This method works with EFS, but it doesn't strictly require EFS – as long as your main account is not an Administrator, you can just rely on the file permissions denying you access.

Downside: Some programs cannot be started with runas, e.g. the Windows Explorer file manager (use a third-party one instead, such as Total Commander) or modern UWP applications.

Or anything else, please? If not Windows-native, then at least available from the File Explorer context menu?

Most file archivers, such as WinRAR or 7-zip, support archiving files through the context menu and encrypting them using AES.

is there a way to prevent unauthorized users from deleting files? I mean I know related permissions can be set in the Windows file properties, but afterwards it only took me (using my default user without read access) to "take ownership" of the file again

Don't make your main account an administrator. Only administrators are allowed to take ownership of objects. (Removing yourself from the admin group should be mostly painless thanks to UAC.)

If you start with the assumption that an unauthorized user has system administrator rights, you will not go far at all. Administrator rights allow destroying data in many different ways.

3
  • Those are some great thoughts, thanks for sharing! One more question, please: after importing the "other" user's certificate in the correct way, will I have to remove it from my default user again in order to protect the files again or can I simply keep it and password-protect the according files? When trying to export/import the certificate I saw an option like "Very secure — promt for password when opening", just it didn't work (maybe just my mistake)?
    – TantoMano
    Feb 9, 2021 at 15:33
  • And regarding your note This method works with EFS, but it doesn't strictly require EFS – as long as your main account is not an Administrator, you can just rely on the file permissions denying you access. would this allow my non-admin user to nevertheless open the files/folders by providing some (admin?) password or how?
    – TantoMano
    Feb 9, 2021 at 15:43
  • Kindly still help me with those two questions/comments and I will mark your answer as 'accepted' — many thanks in advance! :-)
    – TantoMano
    Feb 9, 2021 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .