Confirm EFS keys are Exported (Windows EFS)

EFS is a Windows feature that allows you to encrypt individual files on disk. eazyBackup supports backing up EFS-encrypted files on Windows. The files will be silently decrypted if possible (e.g. if eazyBackup Backup is running as the encryption user, or if eazyBackup Backup is running as the EFS Recovery Agent user).

If it is not possible to automatically decrypt the file for backup, eazyBackup will back up the file in its encrypted form, and will only be able to restore it in its encrypted form. EFS-encrypted files are displayed with green text in the Restore browser dialog in eazyBackup.

If you have a PC failure, the EFS encryption keys may be lost. In this situation, the EFS-encrypted files may be unusable, even after restoring from backup. eazyBackup warns you about this situation by adding a warning message in the backup job log.

In order to safely prepare for this scenario, you should export the PC's EFS encryption keys, so that the files can be accessed after a PC failure. On Windows, you can do this via certmgr.msc; or on Windows Server, taking a System State backup may be sufficient.

Once you have safely backed up the PC's EFS encryption keys, you can suppress the warning in eazyBackup by enabling the "I confirm EFS keys are exported" option in the Protected Item settings.

If you have only a partial PC failure (e.g. files lost, but OS installation and user accounts remain intact), the EFS-encrypted files will be restorable without any further attention to the EFS keys.

Finding files using EFS:

You can use the cipher /u /n command to list all files on the local PC that are EFS-encrypted.

Finding the certificate used to encrypt a file:

You can use the cipher /C C:\path\to\file.txt command to display the user accounts and certificates that are able to decrypt a file. This may indicate which user originally encrypted the file and/or which EFS certificates are necessary for backup.

---

eazyBackup