0

I have a Windows Server 2012 R2, Hyper V VM acting as a domain controller (for domain parihar.local). I am setting up EFS (Encrypted File System) on the same and am running into a very specific issue with Data Recovery Agents (DRA) accounts.

I am using 3 users here to login and test the EFS working. 3 Users are Administrator, maneesh1, deepak. I have set up the Default domain policy to add certificates of Administrator and Maneesh1 as DRA (data recovery agents) accounts.

I create and encrypt a plain text file with deepak account and then encrypt the same. The encryption details shows administrator and maneesh1 as DRAs. I log off from the VM. When I am logging into administrator account I am able to access the files being the DRA and i can even decrypt the same.

However when I am logging into the maneesh1 account I am not able to access or decrypt the file using cipher command or explorer.

I am using self signed certificates and have cross checked the certificate thumbprints of the DRA of the text file using cipher commands. the certificates bearing the same thumbprints are already installed.

Kindly help understand and resolve as to why the second DRA account of maneesh1 is not able to access and decrypt the encrypted file.

Thanks.Kindly let me know for any additional information required. Cannot attach more than 2 images will try and share more during replies if site allows.

enter image description here enter image description here

Improve this question
2
  • 1
    "I create and encrypt a plain text file with deepak account and then encrypt the same." - This sentence is confusing
    – Ramhound
    May 24, 2017 at 17:30
  • apologies for the confusion... it should read "I create a plain text file with deepak account and then encrypt the same".. basically i created a text file opened and wrote some sample text; saved and closed. Then encrypted using right click > Properties > Advanced > Encrypt. Hope it clarifies.Tx
    – Maneesh Parihar
    May 24, 2017 at 18:00

1 Answer 1

Reset to default
0

I realised what was going wrong. I was only importing the cert file for the DRA user account. and the pfx file which contained the private key as well which was required for the DRA to decrypt the encrypted content.

Once I realized the issue. Then i redid the whole thing. Used cipher /R: command to export the cert and pfx keys (recovery keys) and then imported / installed the pfx file (with private key) in the account of the DRA and voila the DRA user was able to access all encrypted content. So the mistake was only importing the cert file and not the entire pfx package with private key. Hope it can help someone eise with the issue as well.

The DRA gets added with only the cert key (in group policy) but while decrypting will definitely require the pfx package imported or installed in the DRA account.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.