Microsoft Windows XP Professional Resource Kit 2003

Encryption is a sensitive operation. It is important that encrypted data not become decrypted inadvertently. To this end, it is recommended that users do the following:

• The most important practice is to have users export their EFS certificates and private keys to removable media, and store the media securely. It is best if users do not remove the private keys from their computers because they will not be able to decrypt any files without importing the private key. The most common EFS-related problem that users encounter is the inability to decrypt files after losing access to the EFS private key in the user profile. Users who switch between operating systems can also benefit from exporting their EFS certificates and private keys. If both operating systems can use EFS, users can import their certificates and keys. This enables them to access their encrypted files when they are logged on to either operating system.

• Export the private keys for recovery accounts, store them in a safe place on secure media, and remove the keys from computers. This prevents someone from using the recovery account on the computer to read files that are encrypted by others. This is especially important for stand-alone computers where the recovery account is the local Administrator or another local account. For example, a portable computer that contains encrypted files might be lost or stolen, but if the private key for recovery is not on the computer, no one can log on as the recovery account and use it to recover files.

• The private keys associated with recovery certificates are extremely sensitive. Export each such key into a .pfx file, protected under a strong password, to removable media, and then physically secure the media.

• Do not use the recovery agent account for any other purpose.

• Do not destroy recovery certificates and private keys when recovery agent policy changes. Keep them in archives until you are sure that all files that are protected by them have been updated with new recovery agent information.

• Encrypt the My Documents folder (RootDirectory\UserProfile\My Documents). This ensures that personal folders where most Microsoft Office documents are saved are encrypted by default. Remember, however, that no files or directories in roaming profiles can be encrypted. Encrypt folders rather than individual files. Applications work on files in various ways; for example, some applications create temporary files in the same folder during editing. These temporary files might or might not be encrypted, and some applications substitute them for the original when the edit is saved. Encrypting at the folder level ensures that files do not get decrypted transparently in this way.

• Never rename or move the RSA folder. This is the only place EFS looks for private keys.

• In a domain, change the default recovery agent account (the Administrator of the first domain controller installed for the domain) as soon as possible, and set a password for each recovery agent account. This adds an extra layer of protection in case the Administrator account is compromised, and provides easy tracking of use of the recovery account.

• Designate two or more recovery agent accounts per organizational unit (a subgroup of computers, or even a single computer, within a domain), depending on the size of the organizational unit. Designate one computer for each designated recovery agent account, and give permission to appropriate administrators to use the recovery agent accounts.

• Implement a recovery agent archive program to ensure that EFS files can be recovered by means of obsolete recovery keys. Recovery certificates and private keys must be exported and stored in a controlled and secure manner. It is recommended that you store archives in a controlled-access vault, and that you have a master archive and a backup archive. The master archive is located on-site; the backup archive is located in a secure off-site location.

• Configure Syskey for stand-alone computers that are not members of a domain to provide startup key protection for the EFS users private keys.

• Encourage users in stand-alone environments to create password reset disks in case they forget their passwords. This enables recovery of the master key for stand-alone computers.

• Use WebDAV folders to store encrypted files that must be transmitted across the network, especially public networks. This ensures that the data is encrypted during transmission.