2

My users have their documents redirected to a share on a file server running NTFS - very regular setup. EFS works and the users are able to encrypt a folder and files in their redirected documents.

The problem which I'm trying to solve and for which I did not find a solution yet, is that the users need to copy some of those files to a share folder to share them with others. At that point, I need the files to be decrypted. But when the files are copied to that share, the files remain encrypted.

That share the files are copied to is a different share than the user documents are in, but on the same file server.

If anyone has data on how to make it so that files copied to a non-encrypted location gets decrypted, of if it is really impossible then fine. Or if there is things I need to look at or other option that is also fine, I'm not stuck on EFS.

ETL
  • 6,513
  • 1
  • 28
  • 48
  • http://superuser.com/questions/188119/how-to-remove-encrypted-flag-when-copying-a-file-from-a-hdd-to-a-usb-drive – NickW Feb 28 '14 at 16:09
  • I don't think you're going to find anything that does it automatically, but in theory, if your server has all the keys, you could periodically do what the answer says using `cipher` in some sort of scheduled task that decrypts the whole directory.. maybe ;) – NickW Feb 28 '14 at 16:11
  • I did read a bit more, supposedly using "non-microsoft" copy methods will remove the EFS (copy to a FAT32 partion, copy using Midnight commander, or SFTP/SCP/etc).. probably not ideal. – NickW Feb 28 '14 at 16:54
  • @NickW - tks - would work for ME, but for my User... probably not! – ETL Feb 28 '14 at 17:03
  • Found "Disabling EFS for a File Folder" in http://technet.microsoft.com/en-us/library/bb457116.aspx .. that works for encrypting new files but does not apply to files being copied unfortunately, was hoping it would decrypt them! – ETL Feb 28 '14 at 17:03
  • Yeah, if you had all the user's private keys.. you could do what they describe under the `Remote EFS Operations in a File Share Environment` section – NickW Feb 28 '14 at 17:10

2 Answers2

1

I found an acceptable alternate solution with Symantec PGP File Share Encryption. With this, you can select various network path and specify that files in that folder should be encrypted and you can give various PGP keys. When you put files there, they get encrypted. When you pull files out of there, they are decrypted.

ETL
  • 6,513
  • 1
  • 28
  • 48
1

The point of EFS is that decryption must be deliberate. If you try and copy an EFS encrypted file to a different computer that doesn't support EFS, then you will get a warning.

Ideally, this is a training issue. Teach your users how to decrypt their files.

longneck
  • 23,082
  • 4
  • 52
  • 86