Control of private keys is crucial to EFS security. If you compromise the private keys, you might find yourself in the position of decrypting and then re-encrypting every encrypted file on your network to re-establish security. Here are key points to remember about securing EFS keys:
- Use caution when deleting a user's profile. The profile contains the user's private key. If you delete the DRA profile, then you lose the ability to recover any files deleted up to the time of the deletion.
- Enforce a policy to remove roaming profiles at logoff. Most importantly, do not permit the domain Administrator account to roam. This leaves a copy of the DRA private key on local desktops.
- Join all computers to a domain to prevent using the local DRA. Files encrypted on a standalone computer cannot be considered secure if the local DRA private key is also on the computer.
- Do not permit a DRA private key to remain on any system. This includes the domain Administrator private key. Anyone with access to the Administrator password can transport an encrypted file to the first domain controller and open the file. Next, we'll see how to export and protect this key.