Think Adoption, NOT Abortion
If this site helped you, please make a donation to:

Feeding families around the world…and the corner.

Romans 5:6   "For when we were yet without strength, in due time Christ died for the ungodly."

XP's Encrypted Files and Folders

Site Visitors 

Three things to remember when you are working with computers.
• First thing is "YOU CAN DO IT".
• Second take your time, a little mistake can cause a big problem.
• Third all answers are only a question away.


TABLE OF CONTENTS is after these links.
Here are some links for online virus program and also free spyware programs.
If you are experiencing computer Problems such as slowness, strange icons appearing, tool bars appearing, home page changing, please use one of the following links to check for a virus or trojan.


• Panda Virus Free Online Virus Scan
  
• AVG Anti-virus Program (FREE)
  • AVG is a great "FREE" program and I used to keep a link to the download but they keep changing it all the time and I can't keep this link up to date so Google "Download AVG Free" to get the download link. SORRY!

Encrypted Files and Folders (Only Available in XP Pro Edition)
• How Files Are Encrypted
• Why You Must Back Up Your Certificates
• Back Up Your Certificate
• Change File attributes in DOS
• Add File attributes in DOS
• Encrypt a Folder in Windows XP
• Encrypt and Decrypt Using the Encrypting File System
• Remove File Encryption in Windows XP
• Decrypting a Folder
• Share Access to Encrypted Files
• Troubleshooting




How Files Are Encrypted
• Files are encrypted through the use of algorithms that essentially rearrange, scramble, and encode the data. A key pair is randomly generated when you encrypt your first file. This key pair is made up of a private and a public key. The key pair is used to encode and decode the encrypted files.
• If the key pair is lost or damaged and you have not designated a recovery agent, then there is no way to recover the data.

Why You Must Back Up Your Certificates
• Because there is no way to recover data that has been encrypted with a corrupted or missing certificate, it is critical that you back up the certificates and store them in a secure location.
• You can also specify a recovery agent. This agent can restore the data. The recovery agent's certificate serves a different purpose than the user's certificate.

Back Up Your Certificate
• Open Internet Explorer.
• On the Tools menu, click Internet Options.
• On the Content tab, in the Certificates section, click Certificates.
• Click the Personal tab.
  • Note: There may be several certificates present, depending on whether you have installed certificates for other purpose.
• Select one certificate at a time until the Certificate Intended Purposes field shows Encrypting File System. This is the certificate that was generated when you encrypted your first folder.
• Click Export to start the Certificate Export Wizard, and then click Next.
• Click Yes, export the private key to export the private key, and then click Next.
• Click Enable Strong protection, and then click Next.
• Type your password. (You need a password to protect the private key.)
• Specify the path where you want to save the key. You can save the key to a floppy disk, another location on the hard disk, or a CD. If the hard disk fails or is reformatted, the key and the backup will be lost. (If you back up the key to a floppy disk or CD, you must store that disk or CD in a secure location.)
• Specify the destination, and then click Next.

Change File attributes in DOS
• Some files can be hidden or can be write protected. When you are doing troubleshooting, sometimes it is necessary to edit these files or delete them.
• To change the attributes of these files type the following
  ATTRIB -R -S -H
• Example how to change the attributes of CONFIG.SYS type the following
  ATTRIB -R -S -H C:\CONFIG.SYS
  • C:\Windows>ATTRIB -R -S -H C:\CONFIG.SYS

Add File Attributes in DOS
• To add the attributes of these files back type the following:
  ATTRIB +R +S +H filename
• Example how to change the attributes of CONFIG.SYS type the following
  ATTRIB +R +S +H C:\MSDOS.SYS
  • C:\Windows>ATTRIB +R +S +H C:\CONFIG.SYS

Encrypt a File For Multiple Users
• Note This procedure applies to Windows XP only. You cannot encrypt a file for multiple users in Windows 2000.
  • Open Windows Explorer
  • Select the encrypted file that you want to add additional users to.
  • Right-click the encrypted file, and then click Properties.
  • Click Advanced to access the EFS settings.
  • Click Details to add additional users.
  • Click Add. The Add dialog box will display any other EFS-capable certificates in your personal store or those of any other users who may be in your "Other People" and "Trusted People" certificate stores.
    • Note:If you do not see the user who you want to add, click Find User to search Active Directory. The Select User window appears. A dialog box displays valid EFS certificates in Active Directory based on your search criteria. If no valid certificate is found for that user, a message will inform you that there are no appropriate certificates for the selected user. In this case, the intended users must send you a copy of their certificate for you to import. You can then add them to your encrypted file.
  • Select the certificate of the user who you want to Add, and then click OK. You will be returned to the Details tab, and the tab will show the multiple users who will have access to the encrypted file and the users' EFS certificates.
  • Repeat this process as necessary until you have added all the users who you want to add. Click OK to register the change and continue.
  • Note: Any user who can decrypt a file can also remove other users if the user who does the decrypting also has write permissions on the file.

Encrypt and Decrypt Using the Encrypting File System
• Note:
  • These guidelines apply to Windows 2000 and Windows XP.
  • You can encrypt files and folders only on volumes that use the NTFS file system.
• Encrypting a Folder
  • Note:Although you can encrypt files individually, Microsoft strongly recommends that you designate a specific folder for storing encrypted data.
  • Encrypt a Folder and Its Contents
    • Although you can encrypt files individually, generally it is a good idea to designate a specific folder where you will store your encrypted files, and to encrypt that folder. If you do this, all files that are created in or moved to this folder will automatically obtain the encrypted attribute.
    • Right-click the folder that you want to encrypt, and then click Properties.
    • In the Properties dialog box, click Advanced.
    • The Advanced Attributes dialog box displays attribute options for compression and encryption. This dialog box also includes archive and indexing attributes.
      Note: Although the NTFS file system supports both compression and encryption, it does not support both at the same time. This means that you can only select one or the other. A file or folder cannot be both encrypted and compressed at the same time.
    • To encrypt the folder, click to select the Encrypt contents to secure data check box, and then click OK.
    • Click OK to close the Advanced Attributes dialog box.
    • If the folder you chose to encrypt already contains files, a Confirm Attribute Changes dialog box will appear.
      You can choose to encrypt only the folder so that all files subsequently moved to the folder or created in this folder will be encrypted. If you want to also encrypt all the contents of this folder, click Apply changes to this folder, subfolders, and files, and then click OK.
  • Decrypting a Folder
    • Right-click the folder that you want to decrypt, and then click Properties.
    • Click Advanced.
    • Click to clear the Encrypt contents to secure data check box to decrypt the data.
    • Click OK to close the Advanced Attributes dialog box.
    • Click OK to close the Properties dialog box.
    • If the folder has files in it, the Confirm Attribute Changes dialog box appears. You can choose to decrypt only the folder. However, this will not decrypt any files currently contained in the folder.
    • If you want to decrypt all the contents of this folder, click Apply changes to this folder, subfolders, and files, and then click OK.
  
  Remove File Encryption in Windows XP
  • Note: Only the user who encrypts a file can recover data that has been encrypted, unless the user specifies a recovery agent before they encrypted the files.
  • To make sure that you have the ability to decrypt files in the future, you should always export your certificate and private key and keep them in a safe place.
  • Only the following people can decrypt an encrypted file.
    • The user who encrypted the file
    • Any user who was designated as a recovery agent before the file was encrypted
    • Any user who has the public key or private key for the recovery agent or the user that originally encrypted the file
    • Any user who has been granted access to the file
  • Members of the Administrators group cannot decrypt files unless the person who encrypted the files designated them as recovery agents before encrypting the files.
  • Note: You must be the original encrypter of the file or a designated recovery agent for the file to use the following steps. If you are not authorized to remove encryption, you receive the following error message:
    • Error Applying Attributes
      An error occurred applying attributes to the file:
      Path:\Filename
    • Access is denied
  • Remove encryption from a file:
    • Use Windows Explorer to browse to the location of the encrypted file that you want to decrypt.
    • Right-click the encrypted file, and then click Properties.
    • On the General tab, click Advanced.
    • Click to clear the Encrypt contents to secure data check box, click OK, and then click OK again.

How to Share Access to Encrypted Files
• Note: You must be a member of the administrators group or the user that encrypted the file in to add users to it. If you are not authorized to add users to an encrypted file, you receive the following error message:
  EFSADU
  Error in adding new user(s). Error code 5.
• You can retain the security of file encryption while allowing specific users access to your encrypted files. To allow access to your encrypted files: .
  • Right-click the encrypted file, and then click Properties.
  • Click the General tab (if it is not already selected), and then click Advanced.
  • Click Details, and then click Add.
  • Select the user you want to share access to the encrypted file with, and then click OK.
  • When you are finished adding users, click OK three times.

Troubleshooting
• Encrypted files are not accessible from Macintosh clients.
• You may be unable to open documents that other users store in your encrypted folder. When a user creates a document in an encrypted folder, only the user that created the document can open it unless they grant access to other users. Because of this, a folder that you encrypt may later contain files that you cannot open. If you require access to these files, ask the creators of these files to add your user account to the list of users with whom the encrypted files are shared.
• The EFS documentation indicates that a user who is granted share access to an EFS encrypted file must also have NTFS Write permission for the file in order to edit it. However, if the file is a Microsoft Office document, the user must have Modify permission for the file in order to edit document. Modify permission includes Write permission.
• You cannot encrypt files or folders on a volume that uses the FAT file system.
  
  To resolve this issue, store the files or folders that you want to encrypt on NTFS volumes.
• You cannot store encrypted files or folders on a remote server that is not "trusted for delegation."
  
  
• To resolve this issue, configure the remote server as being trusted for delegation. To do this, use the following steps.
• Note: You must have administrator privileges to do this.
  • Log on to a domain controller.
  • Start the Active Directory Users and Computers snap-in.
  • In the console tree, expand the domain container. Locate and right-click the server that you want, and then click Properties.
  • On the General tab, select the Trust computer for delegation check box (if it is not already selected). Click OK to respond to the "Active Directory" message that appears.
  • Click OK, and then quit Active Directory Users and Computers.
• You cannot gain access to encrypted files from Macintosh clients.
• You cannot open documents that are stored by others in an encrypted folder that you create.
  
  
• When another user creates a document in an encrypted folder, that document is encrypted, allowing (by default) only that user to gain access. Because of this, a folder that you encrypt may later contain files that you are unable to open. If you require access to these files, request that your user account be added to the list of users with whom the encrypted files are shared.