7

Is there anything wrong with encrypting the search index with EFS while letting the search service index encrypted files? I've encrypted the directory %ProgramData%\Microsoft\Search and I've added SYSTEM user by using "cipher /ADDUSER /certhash:"SYSTEMHASH" /s:thedirectory, and it looks like the SYSTEM account has no problem indexing my files.

However, the recommendation tells me to only index encrypted files when a full-disk encryption is used. Is this a wrong practice?

Improve this question
2
  • @user110236: With EFS, in this particular case, the key cannot be entered, since LocalSystem does not log in interactively, therefore the EFS keys belonging to this system account are only obfuscated; they also are accessible by any Administrator as #2 says. With BitLocker, you always provide the decryption key before Windows can boot, so even though it doesn't protect against rogue Admins, it works fine against physical attacks by outsiders.
    – user1686
    Dec 19, 2011 at 18:15
  • 1
    @grawity: You said, "With BitLocker, you always provide the decryption key before Windows can boot." I used the SysKey utility "to configure a start-up password that must be entered to decrypt the system key so that Windows can access the SAM database." Isn't that the same thing?
    – user110236
    Dec 19, 2011 at 19:05

1 Answer 1

Reset to default
6

Read the reasoning for not just encrypting just the index in this TechNet page

Encrypting the Index To encrypt the index file itself, we recommend that you encrypt the entire volume containing the index with BitLocker or another 3rd party full-volume encryption option. This provides strong protection against offline attacks; online attacks are still possible by users with administrator access. BitLocker Drive Encryption provides enhanced protection against data theft by encrypting data operating system and data volumes. In Windows 7, BitLocker Drive Encryption works on removable drives. We strongly recommend also BitLocking operating system volumes if you BitLock data volumes.

While the Encrypting File System (EFS) can also be used, it is not recommended. The Windows Search service runs under the LocalSystem account and needs access to the index files. As a result, EFS keys associated with the LocalSystem account must be used to encrypt the index files. Consequently, the index files are open to the following attacks:

  • Online: Any administrative user can gain access to the encrypted index files by simply impersonating the LocalSystem account. (Existing tools on the web make this a trivial task.)

  • Offline: The key that is used by the LocalSystem account to decrypt files is stored on the machine in an obfuscated state. Someone with physical access to the machine can use existing tools on the web to retrieve this key and access the encrypted index files.

Improve this answer
1
  • Thank you very much! I can't really upvote you for the lack of reputation though :/
    – wbkang
    Feb 8, 2010 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.