Deploy EFS using GPO - Revision history

Michael.mast: /* Page File / Offline Files */

2016-08-08T16:12:50Z

Page File / Offline Files

2016-06-24T14:25:03Z

Things to Look out for

2016-06-23T23:20:24Z

2016-06-22T13:36:37Z

2016-06-22T13:28:54Z

2016-06-20T20:23:32Z

Without Using CA Server

2016-06-20T19:48:31Z

Decrypt

2016-06-20T19:44:47Z

Decrypt

2016-06-20T19:15:45Z

Without Using CA Server

2016-06-20T19:05:51Z

@@ Line 41: / Line 41: @@
 ===Page File / Offline Files===
 We need to ensure that the Page File and Offline files from network shares are encrypted as well. Thankfully this is an easy GPO switch
   Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options
 *Enable"Shutdown: Clear Virtual memory pagefile"
   Commputer Configuration -> Administrative Templates -> Network -> Offline Files
 *Enable "Encrypt Offline Files Cache"
 ===logon Script===
 Here is a partial batch script for encrypting sensitive areas of the computer

@@ Line 70: / Line 70: @@
 #Now you should be able to open the encrypted files as well as decrypt them.
 ==Things to Look out for==
 *Sometimes when downloading files directly to a shared drive using Chrome, the downloaded file may be saved to the local Downloads directory first then sent to the server. If this happens the file will be encrypted and will not be accessible to anyone else (except the DRA if the server falls under the GPO's scope)

@@ Line 60: / Line 60: @@
 Open up Logon Properties, then click Show Files. Copy the script to this location and close the window. Back in Logon Properties click Add, Browse, then select the script. Apply and Ok all around.
-===Decrypt===
+==Decrypt==
 To decrypt using the DRA:
 #Log into the workstation that has the encrypted files.
@@ Line 69: / Line 69: @@
 ##Browse for the .pfx private key, and make install the cert into the Personal Certificates Store.
 #Now you should be able to open the encrypted files as well as decrypt them.

@@ Line 39: / Line 39: @@
 <br>
 Users should now be able to encrypt their files on their workstations (or, as I will be showing later, run a login script that will take care of it for them.
-==Page File / Offline Files==
+===Page File / Offline Files===
 We need to ensure that the Page File and Offline files from network shares are encrypted as well. Thankfully this is an easy GPO switch
   Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options
@@ Line 45: / Line 45: @@
   Commputer Configuration -> Administrative Templates -> Network -> Offline Files
 *Enable "Encrypt Offline Files Cache"
 ===Decrypt===

@@ Line 39: / Line 39: @@
 <br>
 Users should now be able to encrypt their files on their workstations (or, as I will be showing later, run a login script that will take care of it for them.
 ===Decrypt===
 To decrypt using the DRA:

← Older revision		Revision as of 20:23, 20 June 2016
Line 59:		Line 59:
	https://technet.microsoft.com/en-us/library/cc759721(v=ws.10).aspx<br>		https://technet.microsoft.com/en-us/library/cc759721(v=ws.10).aspx<br>
	http://www.sevenforums.com/tutorials/143662-page-file-encryption-enable-disable.html<br>		http://www.sevenforums.com/tutorials/143662-page-file-encryption-enable-disable.html<br>
		+	http://www.sevenforums.com/tutorials/50718-offline-files-encrypt-unencrypt.html<br>

← Older revision		Revision as of 19:48, 20 June 2016
Line 58:		Line 58:
	https://www.experts-exchange.com/questions/23958388/EFS-Recovery-Agent-DRA-certificate-imported-in-Group-Policy-but-not-deployed-to-clients.html<br>		https://www.experts-exchange.com/questions/23958388/EFS-Recovery-Agent-DRA-certificate-imported-in-Group-Policy-but-not-deployed-to-clients.html<br>
	https://technet.microsoft.com/en-us/library/cc759721(v=ws.10).aspx<br>		https://technet.microsoft.com/en-us/library/cc759721(v=ws.10).aspx<br>
		+	http://www.sevenforums.com/tutorials/143662-page-file-encryption-enable-disable.html<br>

← Older revision		Revision as of 19:44, 20 June 2016
Line 57:		Line 57:
	https://technet.microsoft.com/en-us/library/cc770315(v=ws.10).aspx<br>		https://technet.microsoft.com/en-us/library/cc770315(v=ws.10).aspx<br>
	https://www.experts-exchange.com/questions/23958388/EFS-Recovery-Agent-DRA-certificate-imported-in-Group-Policy-but-not-deployed-to-clients.html<br>		https://www.experts-exchange.com/questions/23958388/EFS-Recovery-Agent-DRA-certificate-imported-in-Group-Policy-but-not-deployed-to-clients.html<br>
		+	https://technet.microsoft.com/en-us/library/cc759721(v=ws.10).aspx<br>

@@ Line 24: / Line 24: @@
 *Edit the following fields
   Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies - Encrypting File System
 *Right Click "Encrypting File System" then "Add Recovery Agent"
 *Select "Browse Folders" and find the Public .cer file that was previously created.
@@ Line 29: / Line 37: @@
 *Under Public Key Policies right click "Trusted Root Certificate" and click import.
 *Import the same .cert Public key as before.
+<br>

@@ Line 22: / Line 22: @@
 *Either edit the default domain policy or create a new GPO under the OU of your choice.<br>
 <i>NOTE</i> : The GPO will be applying policies to the computer and not just the users, so ensure the computers that will be included for encryption are in an OU under the GPO.
+*Edit the following fields