Win XP Pro & Encrypted Folders

[MrMilney]

I've been playing with encrypted folders under Win XP. I encrypted a folder and moved some files into it. I then switched to another user and found that not only could I see the folder I could open it and see all the files contained in it as well. When I tried to open one of the files I was told it was not able to be open but I was under the impression that other users would not be able to see the encrypted folder much less list its contents. Can anyone confirm if this is how they are supposed to work? If not, can you give me a hint where I may have gone wrong?

Thanks...

 

[AndyHui]

Please read the FAQ: How to use EFS and back up your Private Key

You need to set folder level permissions if you want to prevent people from listing the contents of a folder.

 

[Woodie]

That's the way it works, which is to say you're not doing anything wrong.

All the error messages about failures trying to access encrypted files are generated by the application, and very few applications (if any) have been updated to recognize "failure to decrypt" as a specific error message. Even MS Office returns confusing messages about the file being read-only.

Oh, what Andy said.

 

[MrMilney]

I have already backed up my key but thanks for the warning. Always a good idea to be as safe as possible.

I thought my folder-level permissions were ok but when I looked sure enough the Users group had permissions for the folder. Cleared that up and now no one but me is able to view contents of the folder. It just seemed to me that after encrypting the folder it shouldn't have mattered what the permissions were; all the contents should have been unreadable to other.

 

[MrMilney]

Wow, I would have thought that at least Windows Explorer would have been wise to the encrypted folder error. At any rate, locking down permissions achieved the desired results but not as elegantly as I would have liked.

Thanks all for your help!

 

[Nothinman]

It just seemed to me that after encrypting the folder it shouldn't have mattered what the permissions were; all the contents should have been unreadable to other.

Maybe it's just a matter of semantics. The folder is not encrypted, the files inside of it are, if the folder itself was encrypted (the directory entries in the filesystem) you would get garbage back and it would probably break things like chkdsk and probably crash explorer.