Key Archival of EFS Recovery Certificate

As of version 7.6, Backup for Windows supports EFS-encrypted file backup and restore: encrypted files are backed up 'as is', i.e. in an encrypted state. To decrypt these files after restoring them to any location other than the original computer, add the Key Recovery Agent for EFS-encrypted files and archive this Agent certificate to a safe place.

Follow these steps:

• Step 1. Add Key Recovery Agent Certificate Template
• Step 2. Request Personal Administrator Certificate
• Step 3. Add a Key Recovery Agent Certificate Using Group Policy
• Step 4. Force Update Group Policies
• Step 5. Use Key Archival

Step 1. Add Key Recovery Agent Certificate Template

Add the Key Recovery Agent certificate template to the list of available certificate templates.

1. Log in to the Certification Authority computer with administrative rights.
2. In Windows Administrative Tools, click Certification Authority.
3. In Certification Authority, right-click Certificate Templates and select New > Certificate Template to Issue.

4. Select Key Recovery Agent in the list of certificate templates.

5. Click OK to enable this certificate.
6. A Key Recovery Agent certificate template appears in the list of Certificate Templates.

Now you are ready to request a personal administrator certificate using this Key Recovery Agent certificate template.

| Top |

Step 2. Request Personal Administrator Certificate

To request a personal administrator certificate using the Key Recovery Agent template published above, proceed as follows:

1. Open the MMC console and add or select the Certificates snap-in.
2. Right-click the Certificates folder under the personal store, and select All Tasks > Request New Certificate.

3. In the Certificate Enrollment dialog, select Key Recovery Agent in the list of available certificates, then click Enroll.

4. In Certification Authority, click the Pending Requests folder.
5. Right-click your pending request, then select All Tasks > Issue to issue the certificate requested above. Save the Request ID copy of the certificate to a file.

6. The certificate appears in the Issued Certificates folder. Right-click the certificate and select Open.

7. Select Thumbprint and click Copy to file.

8. Export the certificate to a file, for example, archive-admin.cer, with the Certificate Export Wizard. On the Export file format step, select DER encoded binary X.509 (.CER).

9. In the Certification Authority snap-in, add and configure the Recovery Agent. Right-click the domain, then select Properties.

10. Click the Recovery Agents tab.
11. Select the Archive the Key option. Click Add.

12. Select the certificate you issued and verify that the thumbprint of this certificate matches the thumbprint saved to the file above. Click OK.

13. Restart Active Directory Certificate Services for changes to take effect.

14. In Properties, click Recovery Agents to check whether the certificate is valid. Click Cancel.

15. Add a new EFS template based on the Basic EFS template. In Certification Authority, right-click Certificate Templates and select Manage.

16. Right-click the Basic EFS template and select Duplicate Template.

17. Configure the new template properties:
    • Name the template on the General tab.

* On the Request Handling tab, select **Archive subject's encryption private key**.
* On the Cryptography tab, set the minimum key size.

* On the Security tab, grant the Read permission to the Key Recovery Agent account.

18. Click Apply.
19. Publish the created certificate template. In Certification Authority, right-click Certificate Templates and select New > Certificate Template to Issue.

20. Select your template by name and click OK to enable it.

Now you are ready to add this Key Recovery Agent to Group Policy. | Top |

Step 3. Add a Key Recovery Agent Certificate Using Group Policy

1. Open the Group Policy Management snap-in.
2. Right-click Default Domain Policy and select Link Enabled.

3. To edit the Default Domain policy, expand Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies. Right-click Encrypting File System and select Properties.

4. On the General tab for Encrypting File System (EFS), select Allow.
5. On the Certificates tab, select your template as the EFS template for automatic certificate requests and clear the Allow EFS to generate self-signed certificates when a certification authority is not available check box.

6. Click Apply.

Now you are ready to update group policies on the computers where you want to back up EFS files.

| Top |

Step 4. Force Update Group Policies

• Log in to the original client computer and run gpupdate /force.

Now the created Group Policy is used on this computer. You are ready to check whether key archival works properly.

| Top |

Step 5. Use Key Archival

1. Log in to the original computer as a standard user that does not have an EFS certificate.

3. Create and encrypt a file.

4. Make sure that the new user has access to the encrypted file.

5. The same certificate appears in the user's personal store.

6. Log in to the Certification Authority computer.
7. In the Certification Authority snap-in, click View > Add/Remove Columns....

8. Add the Archived Key column and move it to the top of the list. Click OK.

9. Note that a standard user certificate was automatically issued and archived.

10. Install previously exported Recovery Agent certificate c:\archive-admin.cer to the administrator's personal store on the Certification Authority computer.

11. Locate the issued and archived ordinary user EFS certificate in Certification Authority and copy the serial number to the clipboard.

12. Run PowerShell as Administrator.

13. Execute the following commands in the PowerShell window. At the last step, specify the recovered .pfx password.

 cd /

mkdir keyrecoverdir

cd .\keyrecoverdir\

certutil -getkey 170000001b7f4141464204e1b500000000001b rawkeyinfo

certutil -recoverkey .\rawkeyinfo recovered.pfx

14. Now the standard user .pfx certificate is recovered.

15. Log in to the original client computer where you created the EFS-encrypted file.
16. Delete the EFS keys/certificate.
17. Place recovered.pfx in the file system.
18. Install recovered.pfx to the ordinary user's personal certificate store.
19. Log in again to the original client computer to uncache the certificate thumbprint.
20. Try to open your EFS-encrypted file to make sure everything is fine.

| Top |