EFS Enhancements in Windows XP

EFS-Certificate and Private-Key Backup
Given that password reset disks can give you a false sense of security and are vulnerable to theft, you might choose an alternative method of granting a user access to his or her encrypted files. One alternative is to back up the EFS certificate and private key. If you have your EFS certificate and private key, you can always obtain your confidential data.

The first time you use your user account to encrypt a file, XP automatically creates your EFS certificate. You can use the Microsoft Management Console (MMC) Certificates snap-in to view and back up this certificate. To do so, enter

mmc

at the command line and select File, Add/Remove Snap-in. Click Add. Double-click Certificates, then click Finish, Close, and OK. Next, select Console Root, Certificates - Current User, Personal, Certificates. Figure 2 shows my EFS certificate. To back up a certificate, right-click the certificate and select All Tasks, Export. On the Certificate Export Wizard's first page, click Next, then click Yes, export the private key. (A backup copy of your certificate is useless without the private key.) After you click Next twice, the wizard asks for a password with which to protect this key. You won't be able to restore the certificate without this password, so make sure you remember it. Enter the password twice for confirmation, then click Next. The wizard asks for a filename. You can save this certificate and private key either to a disk or to a shared folder on your network. The latter option is convenient if you manage many laptops but introduces a significant security risk. Remember that a skilled attacker who can obtain a copy of the user's certificate and private key and gain access to the user's computer might be able to gain access to the user's encrypted files. Therefore, you might ultimately decide to move backup certificates to an offline CD-ROM that you store in a secure place. . . .