Understanding Encrypting File System
Windows and NTFS provide a method for each person using a computer
to encrypt his or her files, folders, and drives. Encrypting File
System (EFS) is a method used to encrypt files and determine who can
access the files. No administrative privileges are needed to use EFS.
To enable it for a folder, complete the following steps:
-
Locate the folder in File Explorer.
-
Press and hold or right-click the folder to be encrypted.
-
Select Properties.
-
On the General tab of the Properties dialog box, tap or click Advanced.
-
Select the Encrypt Contents To Secure Data check box.
-
Tap or click OK in the Advanced Attributes dialog box.
-
Tap or click Apply in the Properties dialog box.
-
Tap or click OK.
When the folder has been encrypted, a balloon appears, reminding you
to back up your encryption key for the folder. Without that key, you
cannot access the files or folders that are encrypted with EFS. The
encryption key is stored with your user account information in the
operating system; all the files you encrypt with EFS use the same key
per computer.
To back up the private key for your EFS-encrypted files, complete the following steps:
-
Open a blank Microsoft Management Console by searching for MMC on the Start screen.
-
Select File and Add/Remove Snap-In.
-
Select the Certificates snap-in and tap or click Add.
-
Select My User Account as the scope for which this snap-in will manage certificates.
-
Tap or click Finish.
-
Tap or click OK.
-
In the Console window, expand Certificates - Current User.
-
Expand Personal.
-
Select Certificates.
-
In the results pane, locate the certificate with Encrypting File System listed in the Intended Purposes column and tap or click to select it.
-
Under the actions pane for the selected certificate, select More Actions.
-
Select All Tasks.
-
Tap or click Export.
This opens the Certificate Export Wizard. Click Next.
-
Select the Yes, Export The Private Key option and tap or click Next.
-
Select the format for the export file as Personal Information Exchange.
-
Select the option to include all certificates in the path if possible.
-
Tap or click Next.
-
Select the check box to use a password with the file.
-
Type the password.
-
Confirm the password.
-
Tap or click Next.
-
Specify the file name and path for the export and tap or click Next.
-
Review the information about the export.
-
Tap or click Finish to export the certificate and key.
-
Tap or click OK in the Export Successful dialog box.
Note
SECURITY ALERT KEEPING THE EFS KEY
It is a good idea to export the EFS key to an easy-to-remember
location on your computer. After the export is complete, locate the
file and copy it to a location from which you can easily access the
file if needed, such as a removable USB drive.
Encryption is an easy way to enable each person to secure his or her
files and folders on a computer. For some, this can provide peace of
mind when storing files that contain sensitive information on any
computer. Remember, however, that the key file automatically decrypts
files upon opening for the user who encrypted them; if others gain
access to that user account, the files could be compromised.
Important
RECOVERING EFS-ENCRYPTED FILES
Files encrypted with EFS
cannot be recovered without the private key. It is extremely important
for the key to be backed up and kept in a safe place. If people in your
organization intend to use EFS, ensuring that the keys are backed up
regularly in case recovery is needed might be a good idea.
Microsoft BitLocker
is a whole-disk encryption method available in Windows 8 Professional
and Enterprise editions. Like EFS, BitLocker encrypts files to make
their access secure by the owner of the file.
It differs from EFS because it works at the disk level, whereas EFS
allows files to be selected and encryption applied to the folders or
files. In many cases, BitLocker is easier to configure because it is
enabled per disk or volume.
BitLocker is ideal for mobile devices such as laptops and tablets
because the entire device can be misplaced. With BitLocker enabled on
these devices, data cannot be decrypted by whomever has possession of
the mobile device.
Using BitLocker requires either a Trusted Platform Module (TPM) to exist on the computer or a policy to be applied that allows BitLocker to run without TPM.
To configure BitLocker, complete the following steps:
-
From Control Panel, open BitLocker Drive Encryption.
-
Select the drive on which you would like to enable BitLocker.
-
Select the Turn On BitLocker link.
BitLocker encrypts the volume, which might take some time.
In addition to BitLocker, Windows 8 supports BitLocker To Go, which applies BitLocker encryption to removable volumes. This makes data on removable media inaccessible without the encryption key.
Note
USING BITLOCKER WITHOUT TPM
Computers and devices without TPM capabilities can also use
BitLocker. To do this, Group Policy needs to be enabled to allow for
additional security. Using additional authentication, such as a USB key
with an encryption key stored on it, enables you to prove to Windows
and BitLocker who you are and that you should be allowed access to this
data. The policy needed can be found in Computer Configuration\Windows
Components\BitLocker Drive Encryption\Operating System Drives\Require Additional Authentication At Startup.
